sshd config - allow tcp forwarding?

[madwort]

Should we be using all of these settings (e.g. AllowTcpForwarding no) for our git users (we can probably set them globally for this server rather than per-user as the example does)?

https://github.com/opensafely/git-server-proxy/blob/master/setup/sshd_config#L141-L145

[madwort]

Poking the config this morning, confirmed that port forwarding is currently available to the git-read-only user, e.g.

ssh git-read-only@localhost -L 2223:myserver_address:22 -p2222 -N

I don't know exactly where this is deployed, but

• if this is deployed inside a DMZ, it would allow an attacker to address internal servers directly
• presumably the machine this is deployed on will firewall all incoming ports except 2222, which would block this attack, but we should also disable it here.