Advanced Forwarding Security Techniques

Implement advanced techniques to enhance port forwarding security while maintaining necessary functionality.

Certificate-based forwarding restrictions:

# Generate forwarding-specific certificates
# CA for forwarding certificates
ssh-keygen -t ed25519 -f /etc/ssh/forwarding-ca -N ""

# Sign user certificates with forwarding extensions
ssh-keygen -s /etc/ssh/forwarding-ca \
    -I "forward-cert-db-access" \
    -n dbuser \
    -O permit-port-forwarding \
    -O force-command="/usr/bin/true" \
    -O source-address="10.0.0.0/8" \
    -V +4w \
    ~/.ssh/id_ed25519.pub

# Configure server to require certificates for forwarding
# sshd_config
TrustedUserCAKeys /etc/ssh/forwarding-ca.pub
Match User dbuser
    AllowTcpForwarding yes
    PermitOpen database.internal:3306
    PubkeyAcceptedKeyTypes [email protected]

Dynamic forwarding validation:

#!/usr/bin/python3
# validate-dynamic-forward.py
# Proxy validation for dynamic forwards

import socket
import struct
import threading

class SOCKSValidator:
    def __init__(self, listen_port=1080, forward_port=1081):
        self.listen_port = listen_port
        self.forward_port = forward_port
        self.allowed_destinations = [
            ('internal.example.com', 80),
            ('database.internal', 3306)
        ]
    
    def validate_destination(self, addr, port):
        """Check if destination is allowed"""
        for allowed_addr, allowed_port in self.allowed_destinations:
            if addr == allowed_addr and port == allowed_port:
                return True
        return False
    
    def handle_client(self, client_sock):
        # Read SOCKS5 greeting
        greeting = client_sock.recv(262)
        
        # Send authentication method
        client_sock.send(b'\x05\x00')
        
        # Read connection request
        request = client_sock.recv(262)
        
        # Parse destination
        if len(request) >= 10:
            cmd = request[1]
            atyp = request[3]
            
            if atyp == 1:  # IPv4
                addr = socket.inet_ntoa(request[4:8])
                port = struct.unpack('!H', request[8:10])[0]
                
                if self.validate_destination(addr, port):
                    # Forward to actual SOCKS proxy
                    self.forward_connection(client_sock, addr, port)
                else:
                    # Reject connection
                    client_sock.send(b'\x05\x02\x00\x01' + request[4:])
                    client_sock.close()

SSH port forwarding provides powerful capabilities for secure remote access and data transmission, but requires careful configuration and monitoring to prevent security risks. By implementing comprehensive controls, monitoring systems, and access policies, organizations can leverage port forwarding benefits while maintaining strong security postures. Regular audits and updates ensure forwarding configurations remain aligned with security requirements as infrastructure evolves.## SSH Brute Force Prevention

Brute force attacks against SSH services remain one of the most persistent threats facing internet-connected servers. Automated bots continuously scan for SSH services and attempt to gain access using common username and password combinations. While key-based authentication provides strong protection, implementing comprehensive brute force prevention creates multiple defensive layers that protect against various attack scenarios. This chapter explores proven strategies for detecting, preventing, and mitigating SSH brute force attacks.