Restrict Tunneling thru SSH

[Hornet]

On 7/22/05, Trevor Sullivan <pcgeek86 at gmail.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: RIPEMD160
> 
> Hornet wrote:
> 
> > On 7/21/05, Trevor Sullivan <pcgeek86 at gmail.com> wrote:
> >
> >> Hello list, I am curious as to whether or not it is possible to
> >> restrict certain users from tunneling traffic through SSH. I
> >> would like to be able to tunnel my own traffic, but provide user
> >> logins that are restricted from accessing the rest of my inside
> >> network. Is it possible to restrict this by user? Thanks
> >>
> >> Trevor
> >
> > I'm pretty sure it is an all or nothing config option in sshd.conf
> > in the global sense. But you can make specific options for specific
> > hosts.
> >
> So could I possibly restrict SSH tunneling by IP (host)? I guess my
> concern is that if I create a user account, it will be able to tunnel
> to other machines on my network w/o restriction. Is the way to do this
> maybe a DMZ or separate VLAN?
> 
> Trevor

Yes, should be able to do this via your sshd config. I would recommend
using webmin for this. I have not done this before, but it looks do
able. Are your user going to be using ssh, or is this just a SMB box?
If it is just a SMB box, then I would just set the shell account to
"nologin" since that is separate from the SMB account.

Also I guess you could set a up firewall and restrict the ports that
can talk on the LAN.

-Erik-
_______________________________________________
freebsd-questions at freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"

_______________________________________________
freebsd-questions at freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"