Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 2 down vote favorite

Normally an ssh client can request TCP forwarding using the -L command line option. The server can disable this completely using AllowTcpForwarding no. If enabled, the client can request to connect the endpoint to a remote machine other than the sshd server using host in -L port:host:hostport. Is there a way to configure sshd to limit the destination forwarding address to localhost (ie. the sshd server machine itself)?

share|improve this question

1 Answer

up vote 4 down vote accepted

A secure default for an OpenSSH installation will have GatewayPorts set to no. This is precisely that restriction.

edit

See the PermitOpen directive:

Specifies the destinations to which TCP port forwarding is permitted. The forwarding specification must be one of the following forms:

              PermitOpen host:port
              PermitOpen IPv4_addr:port
              PermitOpen [IPv6_addr]:port

Multiple forwards may be specified by separating them with whitespace. An argument of “any” can be used to remove all restrictions and permit any forwarding requests. By default all port forwarding requests are permitted.

share|improve this answer
The GatewayPorts applies to ports forwarded for the client, that is, with the client -R option. I'm looking for a restriction on the destination addresses when using -L. – Greg Hewgill Nov 4 '11 at 0:47
It works both for -R and -L, but I see what you mean now, you want to restrict the origin of a forward to a localhost. That's trickier. Gatewayports restricts the destination . – ata Nov 4 '11 at 1:15
I already have GatewaysPorts no in my sshd_config. I can use ssh -L 1234:anotherhost:1234 server to set up a tunnel to anotherhost. What I want is to allow ssh -L 1234:localhost:1234 server but disallow ssh -L 1234:anotherhost:1234 server. – Greg Hewgill Nov 4 '11 at 1:22
Thank you, PermitOpen is the option I was looking for! Not sure how I missed that in the man page. – Greg Hewgill Nov 4 '11 at 1:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.