[Bug 2582] New: Allow PermitOpen to use a wildcard hostname with a fixed port

[bugzilla-daemon at bugzilla.mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=2582

            Bug ID: 2582
           Summary: Allow PermitOpen to use a wildcard hostname with a
                    fixed port
           Product: Portable OpenSSH
           Version: 7.2p1
          Hardware: All
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: sshd
          Assignee: unassigned-bugs at mindrot.org
          Reporter: openssh at mzpqnxow.com

Created attachment 2826
  --> https://bugzilla.mindrot.org/attachment.cgi?id=2826&action=edit
Patch for PermitOpen hostname wildcard feature

Added FWD_PERMIT_ANY_HOST to add the ability to use an asterisk to
    mean any hostname matches in a PermitOpen rule. This is simple and
    looks like this:

    PermitOpen *:443

    One use case here is when OpenSSH is used to broker connectivity to
    a specific TCP based service in a trusted network when the client
    is in an untrusted network. This allows a simple configuration that
    can allow all forwards to service X without the need to provide a
    large list of every server on the trusted network in the
sshd_config
    file. Doing doing so is impractical when the trusted network is
    larger than a few hosts as a large list of hosts in sshd_config
    would be unwieldy and would need to be updated constantly if the
    trusted network changes often.

    This is a real use case for me- I need to provide this type of
    access to several thousand systems. In any given week there
    might be 2-3 new servers and there might be 2-3 servers that have
    been decommissioned.

    This patch is a huge improvement over allowing all ports to all
    hosts, which is all that I can do at this point without having
    a huge management headache. I was very surprised this wasn't
    supported alongside FWD_PERMIT_ANY_PORT. It's a simple enough
    change. I wonder if there was any debate on this or if it just
    slipped through the cracks as an uncommon use case?

    Note that this doesn't go down the more complex road of allowing
    more finegrained cases. The '*' is NOT actually a pattern, it is
    a symbol that means any host. Using *.bah.org will not work and
    is not intended to work.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.