1

Here port forwarding I means ALL kinds of port forwarding, -D dynamic port forwarding(for socks4 and socks5 now), -L local port forwarding to remote, -R remote port forwarding to local. How to fine grained control them separately? I know there is also permitopen option to permit only specified forwarding to host and port.

And I want to know AllowTcpForwarding in sshd_config will do -L or -R, but not -D?

How to allow -D, but not -L or -R, or this is not possible? I have addedcommand="/bin/echo no-command" to the authorized_keys file.

  1. Allow user to set up an SSH tunnel, but nothing else
  2. How to restrict ssh port forwarding, without denying it?

1 Answer 1

Reset to default
1

Allowing -D but not -L is not possible, since they only differ on the client – as far as the protocol is concerned, both are exactly the same thing (they both open direct-tcpip channels over SSH).

The only difference between them is how the ssh client decides which address to connect to (either specified in the command line, or obtained over SOCKS).

4
  • Yes, -L will forward local_addr:local_port to remote_host:remote_port, and -D will forward local_addr:local_port to unknown_host:unknown_port. So unknown_host:unknow_port will definite contains remote_host:remote_port?
    – schemacs
    Dec 10, 2015 at 6:32
  • Doesn't matter if it does or not. The server does not care. The server does not receive anything like "prepare a -D tunnel please". The server only receives individual requests like "open a tunnel to host:port right now", and they're identical for both -D and -L.
    – user1686
    Dec 10, 2015 at 6:46
  • OK. Thanks. How about disabling -R using permitopen ?
    – schemacs
    Dec 10, 2015 at 11:39
  • That should be possible, since it's in a different direction, but I can't find an option for it.
    – user1686
    Dec 10, 2015 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.