ssh-port-forwarding

(use plain openssh to do remote port forwarding)

There are many good reasons to do secure port forwarding through ssh. For example if you own two servers in different datacenters and you want to connect to a single service which is less restricted when accessed locally (e.g. port 25 for SMTP) or you want to forward a service from a system behind a firewall (e.g. a web service on your home Server).
Traditionally you would use autossh to manage permanent ssh connections. However through many hours of testing this has prooven unreliable in many ways. When connecting multiple times to the same server autossh by default uses the same ports for monitoring, which leads to the termination of at least one connection. There also were inexplicable cases when sshd remained running on the server, while the client was actually disconnected and could not restore the connection due to the broken process on the server.
Luckily opennsh made autossh redundant because it already offers built-in monitoring. No additional monitoring ports are necessary anymore. However, there are quite a few options that you should know about in order to improve security and reliability of such a setup. This is the motivation behind this tutorial.

Disclaimer

When you follow this guide, you can make otherwise protected services accessible to the public Internet (when using ssh -R). This might be an attack vector into your protected network.
When you don't set restrictions properly, an attacker might gain access to your server, either via direct shell access or through forwarding the port of your unprotected service (e.g. a database on localhost).

Server configuration

First become root through sudo su - or su -.

/etc/ssh/sshd_config

Add or change the following lines:

GatewayPorts clientspecified
ClientAliveInterval 5
ClientAliveCountMax 3

This allows any user to forward his local ports to an unprivileged public port on the server (ssh -R). You have to restrict this late on through the permitlisten variable in the authorized_keys file. The other two variables specify how often the server should send keep alive messages and how many missed messages from the client it will tolerate. The same has to be set on the client side, but there it can be done as a parameter.

special user account

on debian you can run the following:

adduser ssh-port-forwarding --system
su ssh-port-forwarding -s '/bin/bash' -c 'mkdir ~/.ssh/; chmod 700 ~/.ssh/; touch ~/.ssh/authorized_keys'

/etc/passwd should look similar to this:
ssh-port-forwarding:x:1001:65534::/home/ssh-port-forwarding:/usr/sbin/nologin
and ls -lsha ~ssh-port-forwarding/.ssh/ should look like this:

4,0K drwx------ 2 ssh-port-forwarding nogroup 4,0K 18. Feb 22:18 .
4,0K drwxr-xr-x 3 ssh-port-forwarding nogroup 4,0K 18. Feb 22:18 ..
   0 -rw-r--r-- 1 ssh-port-forwarding nogroup    0 18. Feb 22:18 authorized_keys

Configuring access rights

This is all done in /home/ssh-port-forwarding/.ssh/authorized_keys.

First use the ssh-keygen command to create a private and public key pair on the client side. Don't type any password! Then use cat ~/.ssh/id_rsa.pub to display the content of your newly created public key. After that add a new line in the authorized_keys file on the server. Use the following line as an example. Your key starts at AAAA... and this all needs to be in a single line per key.
restrict,command="",port-forwarding,permitlisten="localhost:22",permitopen="localhost:22" ssh-rsa AAAA...