4

Can the SSH Forward tunneling destination be restricted on a per user basis?

Example: client 'a' can forward tunnel to 192.168.10.2:22 - only. Client 'b' can forward tunnel to 192.168.11.2:22 - exclusively.

Update

I'm looking to restrict the following tunneling command, on a per user or per group basis:


Requirements:

  • client_a can forward tunnel to 192.168.10.*, exclusive.
  • client_b can forward tunnel to 192.168.11.*, exclusive.

Valid tunneling command (for client_a):

ssh -f client_a@gateway -L localhost:2222:192.168.10.2:22 -N

Invalid tunneling command (for client_a) - SSH connection on gateway should close immediately.

ssh -f client_a@gateway -L localhost:2222:192.168.11.2:22 -N

Valid tunneling command (for client_b):

ssh -f client_b@gateway -L localhost:2222:192.168.11.2:22 -N

Invalid tunneling command (for client_b) - SSH connection on gateway should close immediately.

ssh -f client_b@gateway -L localhost:2222:192.168.10.2:22 -N

Can this restriction be achieved with modifications to the sshd_config?

  • 1
    Why the down vote, it's a reasonable question. – Tom H Feb 12 '18 at 12:41
  • More details would be useful. Are you talking about LocalForward / RemoteForward or the Tunnel configuration option? (e.g. Tunnel Request tun(4) device forwarding between the client and the server. The argument must be ''yes'', ''point-to-point'' (layer 3), ''ethernet'' (layer 2), or ''no''.) – Tom H Feb 12 '18 at 12:50
  • I've added clarification. I already have a configuration in place to only allow tunneling, users cannot log into the gateway and obtain a session - the shell is set to /bin/false, and only TcpPortForwarding is allowed. I would like to restrict which servers they can tunnel via the gateway to; e.g. client_n is restricted to a particular sub-net of servers, which are assigned to client_n. If a client attempts to establish a tunnel to a server which he has not been granted access to - the gateway should immediately terminate the connection. – hermetik Feb 12 '18 at 21:36
2

Assuming its a modern sshd version, /etc/ssh/sshd_config supports the Match and PermitOpen directives, which can be combined to restrict the targets specified by clients setting LocalForward options

PermitOpen
Specifies the destinations to which TCP port forwarding is permitted. The forwarding specification must be one of the following forms:

          PermitOpen host:port
          PermitOpen IPv4_addr:port
          PermitOpen [IPv6_addr]:port

Multiple forwards may be specified by separating them with whites- pace. An argument of “any” can be used to remove all restrictions and permit any forwarding requests. By default all port forwarding requests are permitted. https://www.freebsd.org/cgi/man.cgi?sshd_config(5)

So something like this should work...

Match User client_a
    PermitOpen none
    PermitOpen 192.168.10.2:22

Match User client_b
    PermitOpen none
    PermitOpen 192.168.11.2:22

I am not 100% sure of the ordering of those PermitOpens.. (By default all port forwarding requests are permitted.) so you might have to reverse them, or add a Permit none at the appropriate point to block unmatched forwardings.

Or possibly like this;

Match User client_a
    PermitOpen 192.168.10.2:22

Match User client_b
    PermitOpen 192.168.11.2:22

Match User client_a client_b
    PermitOpen none
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.