SSH Tunnelling: How can I stop users being able to access services bound to localhost via port forwarding?

Question

I want to be able to offer ssh accounts on my Linux server for people to be able to use for SSH tunnelling. All accounts will be locked down with no interactive shell, for tunnelling/port forwarding purposes only. My problem is that I don't want them to be able to access services that are bound to localhost only by doing port forwards like the following:

ssh account@server -L 9999:127.0.0.1:3306 && telnet localhost 9999

Would give access to the default mysql database port. How can I stop this?

I see options in the configuration file for OpenSSH to allow specific ports/hosts, but not to block them.

Answer 1

Port forwarding by the SSH daemon is done by a non-privileged child process of the ssh daemon.

ssh jeff@localhost -R 9999:localhost:22
sudo lsof -i
sshd      4856  jeff   10u  IPv4  21933      0t0  TCP localhost:9999 (LISTEN)

Thus we can see that the SSH process responsible for forwarding ports is owned by the user. There are fancy ways to go about tagging packets for custom handling, but I think the easiest is this:

iptables -A OUTPUT -m owner --gid-owner 1000 -d 127.0.0.0/8 -j REJECT --reject-with icmp-admin-prohibited

Put all your users into the same group, put that group in the rule, and put that rule at the top of your list before any allow rules. Note that I used 127.0.0.0/8 -- anything in the 127 netblock will get you to the local host, so don't just block 127.0.0.1.

Also, consider adding a similar rule to block access to your external interface IP. It is a crafty way to bypass the firewall rules.

Answer 2

Allowing some forms of ssh forwarding / tuneling, but not others

You can edit the sshd config at /etc/ssh/sshd_config to:

• enable reverse forwarding (i.e. -R is allowed, which is what you want)
• but disable local forwarding (i.e. -L is not allowed, which is what you want)

You can do this globally by setting in your sshd_config:

AllowTcpForwarding remote

or you can do it on a per-use basis with:

# disable Tcp Forwarding for all by default
AllowTcpForwarding no

# allow remote Tcp forwarding for user some_username
Match User some_username
    AllowTcpForwarding remote

Note / Edit: locking the user from doing anything else

I did not mention this initially, as it is already mentioned in the initial question, but the user should be denied logging, so that they cannot set up their own forwarder.

You can do this by setting the default shell for the user to /usr/sbin/nologin in the etc/passwd file for example. The user will have to use

ssh -NR remote_port:localhost:local_port some_username@server_address

to set up the reverse tunnel, where the -N command means that this is only for port forwarding, not for attempting to execute command / get a shell.

Looks like (but I have not tried it myself) this can also be done directly in /etc/sshd_config by adding something like (you could send to another / possible custom shell script to display something or do any other action):

Match User some_user
  ForceCommand /usr/sbin/nologin

or possibly (I have not tested if -NR still works then) adding something like this instead if you want to show a banner:

Match User guest
    Banner /etc/ssh/some_custom_banner_in_a_text_file
    DenyUsers guest

Answer 3

If you only fixed port forwardings are permitted, then you may restrict them with permitopen="host:port". Google claimed some commercial ssh daemon that offers a restricted port forwarding option, but that looked global, not just one user.