up vote 2 down vote favorite
1
share [g+] share [fb]

For example, there are 2 computers, A and B. Computer A is a SSH server. Computer B opens and SSH connection/tunnel to computer A. Is it possible to, from Computer A, use the SSH connection/tunnel to access computer B from computer A? Also, how can you disconnect computer B from the SSH without turning off server?

link|improve this question
2  
Only in the movies and on TV. – Software Monk Oct 22 '10 at 1:43
See also this similar question at Unix Stack Exchange. – Gilles Apr 14 '11 at 18:54
feedback

2 Answers

up vote 2 down vote

The basic answer is no: the user on the client computer (B) can run commands on the server computer (A) (therefore the administrator on the client can run commands on the server), but the administrator on the server can only influence what the user is doing on the client.

However this does not mean that the client computer is fully protected from the server administrator. A malicious server administrator could insert some attack code in an executable file that the user will copy to the client computer and execute there.

Furthermore, if the user has opened a tunnel in addition to the ssh connection, this may provide another attack vector. For example, X11 tunnels can pretty much allow the server administrator to remotely control X11 applications running locally on the client machine (e.g. by injecting key presses or clipboard data). Openssh provides some protection (see the descriptions of -X, -Y and ForwardX11Trusted in the Openssh client manual) through the X11 SECURITY extension, but these controls do not provide absolute protection (X11 was not designed with application isolation in mind, so you can't really have security without sacrificing functionality).

link|improve this answer
while true ; do xset -display $REMOTE_DISPLAY s activate ; sleep 1 ; xset -display $REMOTE_DISPLAY dpms force standby ; sleep 2 ; done And yes, I have done that before. – Ignacio Vazquez-Abrams Oct 25 '10 at 2:44
"a malicious server administrator could insert some attack code in an executable file that the user will copy to the client computer and execute there" - this means that the only real vulnerability is if a client copies a file from the server to their local computer and executes it without checking what it is first? – TK Kocheran Jul 15 '11 at 23:00
@TKKocheran That's one obvious vector of attack. If you don't trust the server administrator, don't trust any file you've stored on the server, and don't trust that any command you run on the server has its intended effect. – Gilles Jul 15 '11 at 23:22
feedback
up vote 1 down vote

  1. Only if they've opened up a remote tunnel with it. And even then you can only connect to what it's connected to on their side.

  2. sshd spawns an instance per connection. Simply kill the one they've connected to.

link|improve this answer
How would you go about accessing them if they've tunneled in? – S.H. Oct 22 '10 at 1:20
First use something like nc connected to your end of the tunnel to see what they're showing. If you find something useful, use the appropriate client for that service. – Ignacio Vazquez-Abrams Oct 22 '10 at 1:21
sounds good, thanks. – S.H. Oct 22 '10 at 1:24
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.