jlafon/ansible-duo-security — pull request #2 by skottler (2014-05-06 03:58:00+00:00)
Title: Disable PermitTunnel and AllowTcpForwarding in sshd_config

The problem is that you can bypass two-factor authentication on certain operations when using ForceCommand to prompt the user to enter their OTP after successful initial auth via password/key/GSSAPI. ForceCommand doesn't prevent port forwarding from taking place after initial authentication, which means a user who has gotten access to a machine over brute-force or another unauthorized method can get access to ports which are firewalled or listening only on a loopback interface.

Here's how to reproduce the issue:

1. Have a machine with two-factor enabled using ForceCommand to prompt the user for their second form of auth.
2. Have a service listening on a TCP socket which is not available to the 'outside world'
3. ssh -L 8080:localhost:8080 me@mymachine.com (assuming the service is listening on 127.0.0.1:8080)
4. Log into the machine via SSH key or password, but do not enter your OTP
5. Notice that you can access the service on your local machine on port 8080 without completing two-factor authentication

Disabling these two options eliminates the possiblity of bypassing the second form of auth.