[Bug 2582] New: Allow PermitOpen to use a wildcard hostname with a fixed port
bugzilla-daemon at bugzilla.mindrot.org
bugzilla-daemon at bugzilla.mindrot.org
Mon Jun 6 07:18:12 AEST 2016
https://bugzilla.mindrot.org/show_bug.cgi?id=2582
Bug ID: 2582
Summary: Allow PermitOpen to use a wildcard hostname with a
fixed port
Product: Portable OpenSSH
Version: 7.2p1
Hardware: All
OS: All
Status: NEW
Severity: enhancement
Priority: P5
Component: sshd
Assignee: unassigned-bugs at mindrot.org
Reporter: openssh at mzpqnxow.com
Created attachment 2826
--> https://bugzilla.mindrot.org/attachment.cgi?id=2826&action=edit
Patch for PermitOpen hostname wildcard feature
Added FWD_PERMIT_ANY_HOST to add the ability to use an asterisk to
mean any hostname matches in a PermitOpen rule. This is simple and
looks like this:
PermitOpen *:443
One use case here is when OpenSSH is used to broker connectivity to
a specific TCP based service in a trusted network when the client
is in an untrusted network. This allows a simple configuration that
can allow all forwards to service X without the need to provide a
large list of every server on the trusted network in the
sshd_config
file. Doing doing so is impractical when the trusted network is
larger than a few hosts as a large list of hosts in sshd_config
would be unwieldy and would need to be updated constantly if the
trusted network changes often.
This is a real use case for me- I need to provide this type of
access to several thousand systems. In any given week there
might be 2-3 new servers and there might be 2-3 servers that have
been decommissioned.
This patch is a huge improvement over allowing all ports to all
hosts, which is all that I can do at this point without having
a huge management headache. I was very surprised this wasn't
supported alongside FWD_PERMIT_ANY_PORT. It's a simple enough
change. I wonder if there was any debate on this or if it just
slipped through the cracks as an uncommon use case?
Note that this doesn't go down the more complex road of allowing
more finegrained cases. The '*' is NOT actually a pattern, it is
a symbol that means any host. Using *.bah.org will not work and
is not intended to work.
--
You are receiving this mail because:
You are watching the assignee of the bug.
More information about the openssh-bugs
mailing list