From 7844f357cdd90530eec81340847783f1f1da010b Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Wed, 30 Nov 2016 03:00:05 +0000 Subject: upstream commit Add a sshd_config DisableForwaring option that disables X11, agent, TCP, tunnel and Unix domain socket forwarding, as well as anything else we might implement in the future. This, like the 'restrict' authorized_keys flag, is intended to be a simple and future-proof way of restricting an account. Suggested as a complement to 'restrict' by Jann Horn; ok markus@ Upstream-ID: 203803f66e533a474086b38a59ceb4cf2410fcf7 --- session.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'session.c') diff --git a/session.c b/session.c index 85805f5a0..a08aa69d1 100644 --- a/session.c +++ b/session.c @@ -1,4 +1,4 @@ -/* $OpenBSD: session.c,v 1.285 2016/08/23 16:21:45 otto Exp $ */ +/* $OpenBSD: session.c,v 1.286 2016/11/30 03:00:05 djm Exp $ */ /* * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland * All rights reserved @@ -257,7 +257,7 @@ do_authenticated(Authctxt *authctxt) /* setup the channel layer */ /* XXX - streamlocal? */ - if (no_port_forwarding_flag || + if (no_port_forwarding_flag || options.disable_forwarding || (options.allow_tcp_forwarding & FORWARD_LOCAL) == 0) channel_disable_adm_local_opens(); else -- cgit v1.2.3