10

I want to be able to offer ssh accounts on my Linux server for people to be able to use for SSH tunnelling. All accounts will be locked down with no interactive shell, for tunnelling/port forwarding purposes only. My problem is that I don't want them to be able to access services that are bound to localhost only by doing port forwards like the following:

ssh account@server -L 9999:127.0.0.1:3306 && telnet localhost 9999

Would give access to the default mysql database port. How can I stop this?

I see options in the configuration file for OpenSSH to allow specific ports/hosts, but not to block them.

3 Answers 3

4

Port forwarding by the SSH daemon is done by a non-privileged child process of the ssh daemon.

ssh jeff@localhost -R 9999:localhost:22
sudo lsof -i
sshd      4856  jeff   10u  IPv4  21933      0t0  TCP localhost:9999 (LISTEN)

Thus we can see that the SSH process responsible for forwarding ports is owned by the user. There are fancy ways to go about tagging packets for custom handling, but I think the easiest is this:

iptables -A OUTPUT -m owner --gid-owner 1000 -d 127.0.0.0/8 -j REJECT --reject-with icmp-admin-prohibited

Put all your users into the same group, put that group in the rule, and put that rule at the top of your list before any allow rules. Note that I used 127.0.0.0/8 -- anything in the 127 netblock will get you to the local host, so don't just block 127.0.0.1.

Also, consider adding a similar rule to block access to your external interface IP. It is a crafty way to bypass the firewall rules.

2
  • Do you need another rule for the ethernet device too? Isn't this just covering the loopback device? Dec 18, 2011 at 6:32
  • Thats perfect, thank you so much - I had no idea you could target specific GID's with iptables :D Dec 18, 2011 at 13:35
3

Allowing some forms of ssh forwarding / tuneling, but not others

You can edit the sshd config at /etc/ssh/sshd_config to:

  • enable reverse forwarding (i.e. -R is allowed, which is what you want)
  • but disable local forwarding (i.e. -L is not allowed, which is what you want)

You can do this globally by setting in your sshd_config:

AllowTcpForwarding remote

or you can do it on a per-use basis with:

# disable Tcp Forwarding for all by default
AllowTcpForwarding no

# allow remote Tcp forwarding for user some_username
Match User some_username
    AllowTcpForwarding remote

Note / Edit: locking the user from doing anything else

I did not mention this initially, as it is already mentioned in the initial question, but the user should be denied logging, so that they cannot set up their own forwarder.

You can do this by setting the default shell for the user to /usr/sbin/nologin in the etc/passwd file for example. The user will have to use

ssh -NR remote_port:localhost:local_port some_username@server_address

to set up the reverse tunnel, where the -N command means that this is only for port forwarding, not for attempting to execute command / get a shell.

Looks like (but I have not tried it myself) this can also be done directly in /etc/sshd_config by adding something like (you could send to another / possible custom shell script to display something or do any other action):

Match User some_user
  ForceCommand /usr/sbin/nologin

or possibly (I have not tested if -NR still works then) adding something like this instead if you want to show a banner:

Match User guest
    Banner /etc/ssh/some_custom_banner_in_a_text_file
    DenyUsers guest
6
  • 1
    Ah, I somehow missed the fact that you edited it. Yes, your original was not a well-formed answer. This is much better. I'll let people who are more versed in ssh_config to weigh in on the technical details.
    – schroeder
    Mar 8 at 9:23
  • According to man sshd_config, forwarded users should also be denied shell access.
    – A. Hersean
    Mar 8 at 10:16
  • yes, but this was already a part of the initial post, right? :) "All accounts will be locked down with no interactive shell, for tunnelling/port forwarding purposes only.", from the initial post. Still, can make it clearer in the answer, will edit now.
    – Zorglub29
    Mar 8 at 10:46
  • @A.Hersean added the edit about locking the user from doing anything else, does this look good to you? :)
    – Zorglub29
    Mar 8 at 11:02
  • 1
    Your edit is fine by me. Even though the OP already denied shell access, other readers might not think this is a requirement.
    – A. Hersean
    Mar 8 at 13:01
2

If you only fixed port forwardings are permitted, then you may restrict them with permitopen="host:port". Google claimed some commercial ssh daemon that offers a restricted port forwarding option, but that looked global, not just one user.

1
  • This is usually ill-advised. I find it often comes up to load novel port forwards. Far better to block the handful that really should not work.
    – Joshua
    Mar 27, 2017 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.