Bug 1857

Summary: [RFE] restrict port forwarding to localhost
Product: Portable OpenSSH Reporter: Pierre Ossman <ossman>
Component: sshdAssignee: Assigned to nobody <unassigned-bugs>
Status: CLOSED FIXED    
Severity: enhancement CC: dtucker
Priority: P2    
Version: 5.8p1   
Hardware: All   
OS: All   
Bug Depends on:    
Bug Blocks: 1930    
Attachments:
Description Flags
Add port wildcard to permitopen ("permitopen localhost:*") none

Description Pierre Ossman 2011-02-11 00:36:19 AEDT 
In a nutshell, I'd very much like to see something like GatewayPort for PermitOpen, restricting clients to just services on the machine with sshd.

Currently PermitOpen can only do this if you also specify a certain port. I'd like to allow any port (it is dynamically selected), but prevent people from using the sshd machine as a springboard to other machines. The users will not get a shell, instead ssh is essentially a VPN layer to get access to more insecure network services on the machine.

Bug 1513 might be related, although the focus there is on networks instead of ports. My usecase is limited to restricting to localhost.
Comment 1 Darren Tucker 2011-02-15 15:24:33 AEDT 
Created attachment 1997 [details]
Add port wildcard to permitopen ("permitopen localhost:*")
Comment 2 Damien Miller 2011-09-06 10:34:20 AEST 
Retarget unresolved bugs/features to 6.0 release
Comment 3 Damien Miller 2011-09-06 10:36:32 AEST 
Retarget unresolved bugs/features to 6.0 release
Comment 4 Damien Miller 2011-09-06 10:39:08 AEST 
Retarget unresolved bugs/features to 6.0 release

(try again - bugzilla's "change several" isn't)
Comment 5 Darren Tucker 2011-09-23 10:23:22 AEST 
This has been added and will be in the 6.0 release.

Thanks.
Comment 6 Damien Miller 2016-08-02 10:40:51 AEST 
Close all resolved bugs after 7.3p1 release