From owner-freebsd-security Thu Mar 1 10:32:41 2001 Delivered-To: freebsd-security@freebsd.org Received: from mail.inka.de (quechua.inka.de [212.227.14.2]) by hub.freebsd.org (Postfix) with ESMTP id C1A6E37B71E for ; Thu, 1 Mar 2001 10:32:36 -0800 (PST) (envelope-from daemon@mips.inka.de) Received: from kemoauc.mips.inka.de (uucp@) by mail.inka.de with local-bsmtp id 14YXsR-0001K8-00; Thu, 1 Mar 2001 19:32:35 +0100 Received: (from daemon@localhost) by kemoauc.mips.inka.de (8.11.2/8.11.1) id f21HTpt02588 for freebsd-security@freebsd.org; Thu, 1 Mar 2001 18:29:51 +0100 (CET) (envelope-from daemon) From: naddy@mips.inka.de (Christian Weisgerber) Subject: Re: ssh tricks Date: Thu, 1 Mar 2001 17:29:51 +0000 (UTC) Message-ID: <97m0uf$2gj$1@kemoauc.mips.inka.de> References: <01022819094900.04839@jardan.infowest.com> <15005.49602.104109.812735@nomad.yogotech.com> <20010301004422.B14501@mollari.cthul.hu> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit Originator: naddy@mips.inka.de (Christian Weisgerber) To: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Kris Kennaway wrote: > > Yep. Note, the commercial version SSH1 had the ability to turn on/off > > port forwarding on a per-user and/or a per-port options. > > I can't even find mention of this in the ssh.com version Because Nate's wrong. Ylönen-SSH1 only has a global AllowTcpForwarding switch, as has OpenSSH. It's Ylönen-SSH2 that offers the more fine-grained {Allow,Deny}TcpForwardingFor{Users,Groups} option set. I don't see a way to control forwarding per port. I guess it wouldn't be very hard to add these options to OpenSSH, as you should be able to reuse the existing {Allow,Deny}{Users,Groups} and AllowTcpForwarding code. -- Christian "naddy" Weisgerber naddy@mips.inka.de To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message