How can I stop users being able to access services bound to localhost via SSH port forwarding?

Solution 1:

I haven't tried it myself, but the --uid-owner and --gid-owner options for iptables rules appears to let you restrict connections based on UID and GID. In other words, specific users can be prevented from making outbound connections on a given interface.

So maybe something like this (not tested), to block all access to loopback:

iptables -A OUTPUT -o lo -m owner --uid-owner {USERNAME} -j REJECT

... or if your locked-down accounts are all in the same group:

iptables -A OUTPUT -o lo -m owner --gid-owner {GROUPNAME} -j REJECT

If you need something more granular, this nixCraft post has an example of how to allow some ports, but not others.