Re: SSH tunelling

What you can do is use authorized_keys to control with no-port-forwarding
or permitopen="host:port" options.

I'd personally not want to use a potentially user editable file to control
this, and would rather use some centrally controlled file.

Ofcourse brings in an interesting question about auditing that I've yet to
solve about the setup and logging of tunnels and the user that did it.

Hopefully someone to help there too :)

Gareth



On Fri, 10 Sep 2004, Filip Fafara wrote:

> Date: Fri, 10 Sep 2004 23:59:12 +0200 (CEST)
> From: Filip Fafara <tazzek@tasak.org>
> To: SSH Mailing List <secureshell@securityfocus.com>
> Subject: SSH tunelling
>
> Hi,
> I have a proble and I was hoping You guys could help me. I have to
> restrict a user on a sshd server
> to be able to create only one specific tunnel. It looks like that:
>
> clients-------sshd server---------app server
>
> All clients share one user on sshd server and I don't want them to be able
> to create tunnels to ports or hosts other than specific port
> on app server. Is such restriction possible to achieve on
> a ssh-layer, for example in sshd.conf, or ~/.ssh or do I have to go and
> play with the firewall?
> I would really appreciate any advices and hints.
>
> Filip