Restrict Tunneling thru SSH
hornetmadness at gmail.com
Sat Jul 23 13:52:54 GMT 2005
On 7/22/05, Trevor Sullivan <pcgeek86 at gmail.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: RIPEMD160
> Hornet wrote:
> > On 7/21/05, Trevor Sullivan <pcgeek86 at gmail.com> wrote:
> >> Hello list, I am curious as to whether or not it is possible to
> >> restrict certain users from tunneling traffic through SSH. I
> >> would like to be able to tunnel my own traffic, but provide user
> >> logins that are restricted from accessing the rest of my inside
> >> network. Is it possible to restrict this by user? Thanks
> >> Trevor
> > I'm pretty sure it is an all or nothing config option in sshd.conf
> > in the global sense. But you can make specific options for specific
> > hosts.
> So could I possibly restrict SSH tunneling by IP (host)? I guess my
> concern is that if I create a user account, it will be able to tunnel
> to other machines on my network w/o restriction. Is the way to do this
> maybe a DMZ or separate VLAN?
Yes, should be able to do this via your sshd config. I would recommend
using webmin for this. I have not done this before, but it looks do
able. Are your user going to be using ssh, or is this just a SMB box?
If it is just a SMB box, then I would just set the shell account to
"nologin" since that is separate from the SMB account.
Also I guess you could set a up firewall and restrict the ports that
can talk on the LAN.
freebsd-questions at freebsd.org mailing list
To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"
More information about the freebsd-questions