--nextPart1485218.X5vV2nrtai
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Post by Adriana RodeanHi again,
Maybe i didn't expressed myself right.
ssh -L
30300:localhost:8080 -R 1037:localhost:55555
Client Y to be able to connect with: ssh -L
30300:localhost:8080 -R
1038:localhost:55555
and so on
but client Y should be forbidden to connect with: ssh
-L
30300:localhost:8080 -R 1037:localhost:55555
From what I can tell, your goal is to restrict certain REMOTE port forward
values. I do not think it is possible to place restrictions on REMOTE po=
rt
forwards if port forwarding is enabled in sshd_config. In the
authorized_keys, you can list 'permitopen' options, but this only applies
to LOCAL port forwards.
I'm sorry, i confused the local port forwarding to server with remote to=20
local. In normal configuration possibilities, as Joseph said, there is no a=
ny=20
possible _simple_ option that i can see.
what i see:
=2D iptables won't be useful on such case, yes, openssh will open this port=
with=20
a process owned by your specific user, but, "-m owner" only applies for OUT=
PUT=20
and POSTROUTING chains. What you need is for INPUT chain.
=2D Internal openssh configuration does not provide you any way to limit wh=
at=20
port are allowed to open by an specific user. Only for outgoing connections=
you=20
can see limits, and you can do it without rsa/dss/... certificates using "M=
atch=20
User" directive on sshd_config
=2D--
But there are other useful possibilities... More complex obviously. I will =
not=20
specify exactly how you can use it, but, hope it helps.
LEVEL: MED. EFFICIENCY: LOW=20
1. Monitor/event script, this script will do something like:
kill -9 $(netstat -anpo | grep ^tcp | grep LISTEN | cut -d"/" -f1 | cut -d=
: -
f2,3 | awk '{printf("echo -n \"%s \"; ps -p %s uh\n",$1,$4);}' | bash | awk=
=20
'{printf("%s %s %s\n",$1,$2,$3);}' | grep unmanarc | grep -v ^1234 | cut -d=
' '=20
=2Df3)
where unmanarc is the username wanted, and the 1234 the port that you allow=
=20
for him.=20
Event will result in system detriment because each bind will launch this=20
command, and even both mechanisms will allow the port binding for a short=20
period of time until the script runs...
LEVEL: MED. EFFICIENCY: MED
2. similar script but creating a dynamic rule on iptables, by default every=
=20
port are restricted, when the script detects a match (username-port), the=20
script will open an INPUT rule allowing this port. In reverse, the port wil=
l=20
be completely useless. This script have to have special mechanism to detect=
=20
when you close the SSH, and close the iptables rule too (-D). But... This=
=20
mechanism is prone to a race condition. An attacker could simply=20
LEVEL: HIGH. EFFICIENCY: HIGH
3. Possibly, the most feasible option: SELinux.
It's possible to enforce a policy defining specials _port_t labels, and=20
restricting specific users domains to bind only on labeled ports on the pro=
gram=20
domain. For that, previously, you have to add to selinux the specific unix=
=20
accounts to these user domains.=20
LEVEL: HIGH. EFFICIENCY: HIGH
4. LD_PRELOAD Method.
LD_PRELOAD method will enable you to create a wrapper for bind. This wrappe=
r=20
could check for "getuid();" and check if a port/user are allowed. This=20
database could be hardcoded or could exist in some specific file.=20
=2D---------------
My recommendation: if you really need an efficient mechanism, try with seli=
nux=20
or ld_preload, if you don't, try with scripts.
;-)
=2D-=20
Ing. Aaron G. Mizrachi P. =20
http://www.unmanarc.com
Mobil 1: + 58 416-6143543
Mobil 2: + 58 424-2412503
BBPIN: 0x 247066C1
--nextPart1485218.X5vV2nrtai
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.11 (GNU/Linux)
iEYEABECAAYFAkqGfBEACgkQ2ixydRu83wCyjwCgiVSBsQqn+YxnwEimljNivs5O
KecAoLlIuMExwm6W88PCxiutPwHtwico
=qPKG
-----END PGP SIGNATURE-----
--nextPart1485218.X5vV2nrtai--