Restrict Tunneling thru SSH

Hornet hornetmadness at
Sat Jul 23 14:22:39 GMT 2005

On 7/22/05, Trevor Sullivan <pcgeek86 at> wrote:
> Hash: RIPEMD160
> Hornet wrote:
> > On 7/21/05, Trevor Sullivan <pcgeek86 at> wrote:
> >
> >> Hello list, I am curious as to whether or not it is possible to
> >> restrict certain users from tunneling traffic through SSH. I
> >> would like to be able to tunnel my own traffic, but provide user
> >> logins that are restricted from accessing the rest of my inside
> >> network. Is it possible to restrict this by user? Thanks
> >>
> >> Trevor
> >
> > I'm pretty sure it is an all or nothing config option in sshd.conf
> > in the global sense. But you can make specific options for specific
> > hosts.
> >
> So could I possibly restrict SSH tunneling by IP (host)? I guess my
> concern is that if I create a user account, it will be able to tunnel
> to other machines on my network w/o restriction. Is the way to do this
> maybe a DMZ or separate VLAN?
> Trevor

Yes, should be able to do this via your sshd config. I would recommend
using webmin for this. I have not done this before, but it looks do
able. Are your user going to be using ssh, or is this just a SMB box?
If it is just a SMB box, then I would just set the shell account to
"nologin" since that is separate from the SMB account.

Also I guess you could set a up firewall and restrict the ports that
can talk on the LAN.

freebsd-questions at mailing list
To unsubscribe, send any mail to "freebsd-questions-unsubscribe at"

freebsd-questions at mailing list
To unsubscribe, send any mail to "freebsd-questions-unsubscribe at"

More information about the freebsd-questions mailing list