While setting up a new VPS instance running Ubuntu, I found that I needed to set
AllowTcpForwarding yes in
/etc/ssh/sshd_config to achieve a remote VS Code connection. I am and will be the sole user who can log in on that instance, root login is disabled and I use only hardware-backed keys. The server will be running a host of monitoring software and exposing their web UI through HTTPS only.
In such an environment, what are the security implications of
AllowTcpForwarding yes? To my understanding, the SSH tunnel used by
vscode-server will effectively bypass any firewall on the host machine. Would a malicious VS Code extension then be able to compromise the server when I use VS Code's remote functionality?
The obvious choice for me would probably be disabling TCP forwarding after I'm done with the initial setup. (I use some very hardware-specific software and developing straight on the server makes the setup so much easier.) However, I'm inclined to explore the possibility of leaving TCP forwarding on, as it would probably come in handy later, as well.