On Thu, Nov 23, 2006 at 06:26:03PM +0100, Alexander Tampermeier wrote:
When using remote port forwarding: Is there a way to restrict the client in
the number of remote forwarding ports? In other words: I want the client to
be restricted, so that he can only remote-forward "ssh
-R15555:localhost:15000" and no other port on the server except 15000.
Without such a restriction the client would be able to "redirect" arbitrary
host-ports to where ever he likes.
If I understand what you're asking, it's probably worth pointing out
that it's already possible to do this kind of port redirection in
general with TCP/IP without dealing with SSH's port redirection...
there's not much you can do to prevent it. Anyone capable of writing
socket code in C can write a program to redirect any port to anywhere
in maybe a couple of dozen lines. All that's required to do this is
that the user have access to a machine which can connect to the
host/ports he wants to, and access to a C compiler on some machine
which is capable of producing executables which will run on the target
proxy machine. This technique can be used to get around your local
port forward limitations, as well, assuming the user has shell access
to the machine. Anyone who really wants to do this is probably going
to do it whether you explicitly allow it or not.
Someone's probably already written a free program to do this kind of
port redirection, which can be downloaded freely. It might even have
pre-comiled binaries for your platform(s). Another way to accomplish
the same thing without writing the code is to use a Linux box that one
has root access to (or similar) to use firewall rules to do network
address / port translation.
Worse yet, these methods of circumventing access will not use
encryption... any traffic they redirect this way will not be encrypted
(unless they're redirecting a service that inherently uses encryption
already). So you're probably better off not bothering to try to lock
this down... at least, not by restricting SSH's ability to forward
ports. At least then, you can be sure the traffic will be encrypted.
--
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D
pgp2I987mi0e7.pgp
Description: PGP signature
