OpenSSH-Client without reverse tunnel ability

mlrx
Wed, 04 Apr 2018 15:26:33 -0000

Le 04/04/2018 ? 13:32, Jan Bergner a ?crit?:
> Good day!
>
> A few weeks ago, we had a security breach in the company I'm working
> for, because employees used "ssh -R" to expose systems from our
internal
> network to some SSH server in the outer world.
>
> Of course, this is a breach of our internal security policy, but lead us
> to wonder, whether there is a technical solution to prevent our users
> from creating SSH-reverse-tunnels.
>
> After a lot of googleing, there seems to be no option for the
> system-wide client config that would do the trick nor any other suitable
> solution. (Watching ps is not sufficient, as the users can also specify
> reverse tunnels in their client config or create them from an already
> existing connection.)
>
> Is it possible to achieve this without nasty workarounds like wrapper
> scripts monitoring the very-verbose output of SSH or doing DPI?
> Alternatively, would it be possible to add a config option, allowing an
> administrator to disable reverse port forwarding or limit it's
destinations?
>
>
> Thank you in advance,
>
> Jan Bergner

Hello,

No -totally sure- way without DPI and/or proxy, I think.

But, may be a combination of MATCH blocks with
PermitTunnel can be useful?
According your needs, something like:

PermitTunnel no  #(default)
Match Address other.corp.site.IP,123.123.123.123
   PermitTunnel Ethernet
Match group admin1
   PermitTunnel point-to-point
Match user root
   PermitTunnel yes

Regards,
--
benoist

--
benoist