Greetings.
I have modified openssh to support explicitly binding to a local IP
address. This addition was driven by the requirement that only certain
IPs can ssh into target machines of ours, and these IP addresses are
interface aliases which float among various server machines. By default,
without explicitly binding, the originating address of outbound ssh
connections, like all other unbound sockets, is determined by the kernel,
which usually defaults to the primary IP of the interface from which it
sends the traffic.
The syntax for specifying this option is "-A <local addr>". Of
course,
this must be a configured address on the machine. I would have no
problem with changing the name of this option from "-A" to something
else.
Another potential change is to specify the local port to which to
bind. Since I did not have a need for this, I did not do it, but
others might. If they do, then the function opt_bind_socket() could
be extended to support this as well.
I figured that other people may also have this problem, and so I have
made a patch with my changes and am submitting it for inclusion into the
openssh distribution. This code is copyright by myself, Todd Lewis, and
I provide it under the terms of the standard openssh license as specified
in section 4 of the "LICENSE" file in the openssh-2.3.0p1 release.
I ask that this functionality be included in the main openssh
distribution.
--
Todd Lewis tlewis at secureworks.net
Director of Technical Operations SecureWorks, Inc.