In the man pages for
sshd_config, for the
AllowTCPForwarding option, it states:
Specifies whether TCP forwarding is permitted. The default is “yes”. Note that disabling TCP forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders.
Can someone please elaborate? I do not understand how someone can install their own forwarder to circumvent TcpForwarding. Would one have to install a proxy server of sorts and then create a tunnel to the remote proxy server?