Re: Prevent some port forwarding

From: Tony Finch (dot_at_dotat.at)
Date: 06/07/04 

Date: 07 Jun 2004 18:01:37 +0100 (BST)

dtucker@dodgy.net.au (Darren Tucker) wrote:
>doff <lefevred.antispoum@free.fr> wrote:
>>is there a way in openssh, to tell sshd to accept port forwarding, only
>>for one or two ports and reject others ?
>
>Yes, if you're using public-key authentication. It's in the sshd
>man page under "AUTHORIZED_KEYS FILE FORMAT":
>
> permitopen="host:port"
> Limit local ``ssh -L'' port forwarding such that it may only con-
> nect to the specified host and port. IPv6 addresses can be spec-
> ified with an alternative syntax: host/port. Multiple permitopen
> options may be applied separated by commas. No pattern matching
> is performed on the specified hostnames, they must be literal
> domains or addresses.

However users can usually overwrite the authorized_keys file to get around
the restriction.

You might be interested in the patch in the following post to the
openssh-unix-dev list. It hasn't been updated to a recent version
of openssh, I'm afraid, so it might not be totally easy to deploy.

http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=104387691708672&w=2

Tony. 

-- 
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
SELSEY BILL TO LYME REGIS: VARYING BETWEEN SOUTH AND EAST 3 OR LESS. MAINLY
FAIR. MODERATE OR GOOD. SLIGHT.

Relevant Pages

  • Sshd to listen on another port
    ... I just installed sshd (openssh) on a 11i system. ... default sshd port to another port. ... I added an entry in /etc/services ...
    (comp.sys.hp.hpux)
  • How did this happen?
    ... May 12 06:50:43 localhost sshd: Failed password for illegal user ... cgi from 212.93.149.205 port 2265 ... Starting sshd: ...
    (comp.os.linux.security)
  • FreeBSD Security Advisory: FreeBSD-SA-01:63.openssh
    ... OpenSSH is an implementation of the SSH1 and SSH2 secure shell ... An experimental upgrade package is available for users who wish to ... Verify the detached PGP signature using your PGP utility. ... Upgrade your entire ports collection and rebuild the OpenSSH port. ...
    (FreeBSD-Security)
  • FreeBSD Security Advisory FreeBSD-SA-01:63.openssh
    ... OpenSSH is an implementation of the SSH1 and SSH2 secure shell ... An experimental upgrade package is available for users who wish to ... Verify the detached PGP signature using your PGP utility. ... Upgrade your entire ports collection and rebuild the OpenSSH port. ...
    (FreeBSD-Security)
  • Re: bypassing employers proxy to surf anonymously
    ... port 443, so it's harder to distinguish from an https server. ... through the remote sshd. ... You have an option to go with a managed service or an enterprise software. ...
    (Pen-Test)