mjhjmtu

Background

I got a service that connects to a third-party SFTP site to pull files. The third-party has a system that when certain users try to connect, it automatically blocks the incoming IP.
Someone is doing some connection attempts while using the forbidden user as due to be a legacy system, any user gets to the system as root. Whenever this individual tries the sftp root@remote-site he/she just breaks a couple of applications that rely on the same remote SFTP.

Question
Is there any way with SSH to block this outgoing connection for a specific user@site?
Match rule is for sshd_config which is basically incoming. Is there an equivalent for ssh client?

The Match rule for sshd_config works also for ssh_config, and in particular the global /etc/ssh/ssh_config file which you can edit to contain:

Match host site user root
 Hostname DontDoThat

This will replace the hostname when you do an ssh or sftp:

$ sftp root@site
Couldn't read packet: Connection reset by peer

$ sudo sftp site
ssh: Could not resolve hostname dontdothat: Name or service not known

Of course, the user's ~/.ssh/config file can still override this setting.

You might want to log information about the person doing the sftp by adding to the Match line a call of a script (that must exit 0), eg exec "/bin/mylogger somearg..." (don't use single quotes).

You have to use iptable, for example:

Block outgoing ssh connection for 192.168.1.0/24 subnet

 iptables -I OUTPUT -d 192.168.1.0/24 -p tcp --dport 22 -j REJECT

Then verify

ssh -v 192.168.1.6
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to 192.168.1.6 [192.168.1.6] port 22.
debug1: connect to address 192.168.1.6 port 22: **Connection refused**
ssh: connect to host 192.168.1.6 port 22: **Connection refused**

You can always allow outgoing SSH connection with iptables "user" module:

iptables -A OUTPUT -o eth0 -p tcp --destination-port 22 -m owner --uid-owner USERNAME -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --destination-port 22 -j DROP

This will block all outgoing ssh connections, but allow USERNAME to perform it.