Is it possible to limit which hosts are accessible through SSH tunneling?

Question

I have a box that runs both an ssh server and a webserver.

• I would like to prevent people with ssh accounts from using this box as an anonymous proxy to the rest of the Internet (e.g. by creating a tunnel and using it as a SOCKS proxy).
• I would like to allow people with ssh accounts to use this box as a proxy to access the local webserver.

So for example:

1. Open a tunnel: ssh -D1234 myhost.com
2. Configure the browser to use localhost:1234 as a proxy
3. Accessing myhost.com through this proxy should work
4. Accessing any other host through this proxy should fail

I suppose this could be accomplished in a rough way by simply closing outgoing port 80, but this would (a) not prevent people from tunneling non-web traffic, and (b) prevent any user on the box from accessing websites. Is a finer-grained way of doing this, ideally by limiting what sshd will agree to tunnel, possible?

Answer 1

You can limit the hosts that are reachable via tunnel with the PermitOpen option in the sshd_config file.

PermitOpen <TheIPYourWebServerListensOn>:80

If you use localhost as TheIPYourWebServerListensOnyou will probably need to instruct your proxy client to use it even for requests addressed to localhost. Something that may be confusing.

Also, please, bear in mind that over SOCKS5, DNS resolution happens/can happen at proxy side which allows very convenient setups like defining local aliases for the server in the hosts file.

Forgot to say that you can add multiple host:port combinations. You just need to separate them with whitespace. The sshd_config man page is the reference here. Hope this helps!

Answer 2

With PermitOpen in sshd_config you can certainly achieve this kind of setup.

However, keep in mind that disabling port forwarding alone will not actually improve security, if you still allow users shell login: they can access the Internet from the server directly and even install their own forwarders. You must have trust in your shell users anyway.

If you need to prevent users accessing the certain port ranges or even whole Internet directly (only allow to use local services, e.g. send and receive mail), you can use iptables' extended packet matching modules, precisely the module owner, which allows filtering packets based on owners uid or gid and even by process name.