1

While setting up a new VPS instance running Ubuntu, I found that I needed to set AllowTcpForwarding yes in /etc/ssh/sshd_config to achieve a remote VS Code connection. I am and will be the sole user who can log in on that instance, root login is disabled and I use only hardware-backed keys. The server will be running a host of monitoring software and exposing their web UI through HTTPS only.

In such an environment, what are the security implications of AllowTcpForwarding yes? To my understanding, the SSH tunnel used by vscode-server will effectively bypass any firewall on the host machine. Would a malicious VS Code extension then be able to compromise the server when I use VS Code's remote functionality?

The obvious choice for me would probably be disabling TCP forwarding after I'm done with the initial setup. (I use some very hardware-specific software and developing straight on the server makes the setup so much easier.) However, I'm inclined to explore the possibility of leaving TCP forwarding on, as it would probably come in handy later, as well.

Improve this question

1 Answer 1

Reset to default
1
  • A malicious VS Code extension would run under your user id. Therefore VSCode asks you if you trust the owners of each directory you open. Did you open your home?
  • That you use a hardware key does not help if your AuthorizedKeysFile is writable by VSCode. See section CERTIFICATES in man 1 ssh-keygen, or move AuthorizedKeysFile to a root-managed path.
  • An option value that would reduce the blast radius is AllowTcpForwarding local
  • Further mitigate the risks of AllowTcpForwarding in the network security groups of your VPS.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .