1

I'm trying to restrict users who connect via ssh on a server (with OpenSSH) to do local port forwarding on certain ports only.

I've found that setting the permitopen="address:port" option in their ~/.ssh/authorized_keys files do what I expect.

However it is not very convenient since I have to edit all existing authorized_keys files and if, in the future, I want to allow more ports, change the allowed ports,... I will have to edit them all again.

Is something similar achievable for all users in a group i.e. "allow local port forwarding only on address:port if the user belongs to this group"?

Thanks!

EDIT> it seems that the sshd_config file has a feature which allows this: Match. I can match an user or a group and apply some custom configs for them among which PermitOpen which I must have skipped while reading the man page for the first time.

2
  • Is using a script to do the editing of ~${username}/.ssh/authorized_keys an option ?
    – Karolos
    Feb 10, 2012 at 15:54
  • I would prefer to do it otherwise, but yes it is definitely the option I will choose if nothing else is possible :) I will have to improve my bash skills though.
    – ixM
    Feb 10, 2012 at 17:51

1 Answer 1

1

You can specify conditional blocks in /etc/ssh/sshd_config and apply directives like PermitOpen to restrict what users can do. The following would allow members of the restricted group to only tunnel connections to port 1234 on the server and port 80 on google.com

Match Group restricted
    PermitOpen localhost:1234 google.com:80
1
  • yes, that's what I noticed in my edit. Flagging it as the right answer though.
    – ixM
    Jun 6, 2012 at 11:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .