linux: configure sshd server to allow port forwarding

Configuring an SSH server to allow port forwarding usually involves modifying the relevant settings in thesshd_config file. Here are the basic steps of the configuration process:

The basic steps

1. Edit sshd configuration file:
   Open the SSH server configuration filesshd_config. This file is usually located in the /etc/ssh/ directory.

   sudo nano /etc/ssh/sshd_config
   

2. Configure port forwarding:
   In the sshd_config file, find the following options related to port forwarding, and Set up as needed:

   • AllowTcpForwarding: Set to yes to allow TCP port forwarding.
   • GatewayPorts: Set to yes to allow remote hosts to connect to the forwarded port.
   • X11Forwarding: If you need to allow X11 forwarding, set it to yes.

   For example:

   AllowTcpForwarding yes
   GatewayPorts yes
   X11Forwarding yes
   

   Note: If these options are commented out in the file (starting with #), you need to uncomment them.

3. Restart the sshd service:
   After modifying the configuration, you need to restart the SSH service for the changes to take effect.

   sudo systemctl restart sshd
   

security considerations

• Restrict access: Allowing port forwarding may pose a security risk, so it is recommended that this feature be restricted to trusted users.
• Firewall Settings: Ensure that firewall rules allow forwarded port traffic.
• Use key authentication: To improve security, it is recommended to use an SSH key pair for authentication instead of relying solely on passwords.

Application scenarios

• Working remotely: SSH port forwarding provides secure access to internal network services behind a firewall or NAT.
• Development and Testing: Developers can use port forwarding to access databases or web services running on remote servers.