upstream commit

Add a sshd_config DisableForwaring option that disables
X11, agent, TCP, tunnel and Unix domain socket forwarding, as well as
anything else we might implement in the future.

This, like the 'restrict' authorized_keys flag, is intended to be a
simple and future-proof way of restricting an account. Suggested as
a complement to 'restrict' by Jann Horn; ok markus@

Upstream-ID: 203803f66e533a474086b38a59ceb4cf2410fcf7

1 files changed, 2 insertions, 2 deletions

diff --git a/session.c b/session.c
index 85805f5a0..a08aa69d1 100644
--- a/session.c
+++ b/session.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.c,v 1.285 2016/08/23 16:21:45 otto Exp $ */
+/* $OpenBSD: session.c,v 1.286 2016/11/30 03:00:05 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -257,7 +257,7 @@ do_authenticated(Authctxt *authctxt)
 
         /* setup the channel layer */
         /* XXX - streamlocal? */
-        if (no_port_forwarding_flag ||
+        if (no_port_forwarding_flag || options.disable_forwarding ||
             (options.allow_tcp_forwarding & FORWARD_LOCAL) == 0)
                 channel_disable_adm_local_opens();
         else