The amount of useful stuff you can do with this is amazing. Ought to document some of them in a separate document here.

ssh -L [LOCAL_PORT]:[DEST_IP]:[DEST_PORT] [USER]@[REMOTE_IP]
ssh -J ...

ProxyJump

Tunneling stuff: https://linuxize.com/post/how-to-setup-ssh-tunneling/

AllowTcpForwarding yes should be enabled to forward TCP connections. Don't forget to restart the sshd service to allow changes to /etc/ssh/sshd_config to be reflected.

Set directory to cd into via SSH config file, instead of as a command line option:

Host {{NAME}}
    HostName {{TARGET}}
    User {{USER}}
    IdentitiesOnly yes
    IdentityFile {{KEYFILE}}
    
    # Jump/bastion host
    ProxyJump {{PROXY_TARGET}}
    
    # Request for output if input is a terminal
    RequestTTY yes
    RemoteCommand cd {{DESTINATION}} && exec bash --login

Restricting access to SSH-based key logins: https://unix.stackexchange.com/questions/110879/restrict-password-less-backup-with-sftp

Restricted shells are not a popular method, because of the difficulties in locking down the shell to prevent full shell access. Some examples of restricted shells and associated vulnerabilities:

• scponly: CVE
• MySecureShell: PoC attack

Articles:

• https://www.guyrutenberg.com/2014/01/14/restricting-ssh-access-to-rsync/
• rrsync: https://ftp.samba.org/pub/unpacked/rsync/support/rrsync
  • https://bugzilla.samba.org/show_bug.cgi?id=11879
• SSH keys limit:
  • https://serverfault.com/questions/852309/limit-ssh-key-to-scp-only
  • https://serverfault.com/questions/83856/allow-scp-but-not-actual-login-using-ssh
  • https://unix.stackexchange.com/questions/9837/do-you-need-a-shell-for-scp
  • https://unix.stackexchange.com/questions/110879/restrict-password-less-backup-with-sftp
  • https://unix.stackexchange.com/questions/710397/prevent-users-abusing-private-ssh-keys
  • https://unix.stackexchange.com/questions/675214/duplicity-how-to-prevent-malicious-user-from-messing-with-backups
  • https://serverfault.com/questions/543039/backup-a-remote-directory-with-duplicity
  • https://unix.stackexchange.com/questions/33271/how-to-avoid-ssh-asking-permission
  • https://serverfault.com/questions/969606/secure-offsite-backup-even-in-the-case-of-hacker-root-access
  • https://security.stackexchange.com/questions/185861/encryption-for-efficient-rsync

sshuttle is my new favorite toy, that solves the problem of redirecting traffic without a need for remote configuration. Typical use case for me includes accessing network resources restricted only to network addresses.

user:~$ sshuttle --dns -NHr <USER>@<IP_ADDR> 10.0.0.0/8
user:~$ pkill sshuttle

See this for a guide on configuring it as a service, and performing multi-hops (>1 jump servers).

# For SSH tunneling control
status:
        ssh -S lightstick.ctl -TO check alice
up:
        ssh -MS lightstick.ctl -fNT -L 445:192.168.101.165:445 alice
down:
        ssh -S lightstick.ctl -TO exit alice