Restrict a client port-forward to 1 port
|
View:
New views
10 Messages
—
Rating Filter:
Alert me
|
 |
Restrict a client port-forward to 1 port
by Adrya-2
::
Rate this Message:
|
|
|
Re: Restrict a client port-forward to 1 port
by Joseph Spenner
::
Rate this Message:
|
|
|
Re: Restrict a client port-forward to 1 port
by Aarón Mizrachi
::
Rate this Message:
On Miércoles 12 Agosto 2009 11:53:30 Adriana Rodean escribió:
> Hi, > > Is it possible to restrict a client port-forwarding to one port? > For example i want client X to open only port 1037 on server through > port-forwarding, client Y only port 1038 and so on... > How can this be possible? > I use private/public keys authentication. > Client version is openssh3.8p1, is windows client, and server version > is latest openssh on a linux machine. > > Can anyone help please? > each instance of ssh are excecuted with the UID determined by the SSH logon: Log example: [GWCONN]: IN= OUT=wan0 SRC=_._._._ DST=_._._._ LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=9946 DF PROTO=TCP SPT=46684 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A2E3B8D980000000001030305) UID=500 GID=500 if you set some rule like: iptables -I OUTPUT -o \! lo -m owner --uid-owner 500 -j LOGDROP iptables -I OUTPUT -m owner --uid-owner 500 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT you will enable only the port 80 for UID 500 (usernames can be used also). but remember the -o \! lo, that means that iptables won't block any connection from UID 500 to localhost, which is needed for ssh internal work. ;-) Hope it helps. > Thank you so much, > Adriana -- Ing. Aaron G. Mizrachi P. http://www.unmanarc.com Mobil 1: + 58 416-6143543 Mobil 2: + 58 424-2412503 BBPIN: 0x 247066C1 |
|
|
Re: Restrict a client port-forward to 1 port
by Aarón Mizrachi
::
Rate this Message:
On Miércoles 12 Agosto 2009 16:42:54 Aarón Mizrachi escribió:
> On Miércoles 12 Agosto 2009 11:53:30 Adriana Rodean escribió: > > Hi, > > > > Is it possible to restrict a client port-forwarding to one port? > > For example i want client X to open only port 1037 on server through > > port-forwarding, client Y only port 1038 and so on... > > How can this be possible? > > I use private/public keys authentication. > > Client version is openssh3.8p1, is windows client, and server version > > is latest openssh on a linux machine. > > > > Can anyone help please? > > Indeed. With iptables. > > each instance of ssh are excecuted with the UID determined by the SSH > logon: > > Log example: > > [GWCONN]: IN= OUT=wan0 SRC=_._._._ DST=_._._._ LEN=60 TOS=0x00 PREC=0x00 > TTL=64 ID=9946 DF PROTO=TCP SPT=46684 DPT=80 WINDOW=5840 RES=0x00 SYN > URGP=0 OPT (020405B40402080A2E3B8D980000000001030305) UID=500 GID=500 > > if you set some rule like: > > iptables -I OUTPUT -o \! lo -m owner --uid-owner 500 -j LOGDROP > iptables -I OUTPUT -m owner --uid-owner 500 -p tcp -m state --state NEW -m > tcp --dport 80 -j ACCEPT > The sentence without logdrop: iptables -I OUTPUT -o \! lo -m owner --uid-owner 500 -j DROP iptables -I OUTPUT -m owner --uid-owner 500 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT ;-) > you will enable only the port 80 for UID 500 (usernames can be used also). > > but remember the -o \! lo, that means that iptables won't block any > connection from UID 500 to localhost, which is needed for ssh internal > work. > > > ;-) > > Hope it helps. > > > Thank you so much, > > Adriana Ing. Aaron G. Mizrachi P. http://www.unmanarc.com Mobil 1: + 58 416-6143543 Mobil 2: + 58 424-2412503 BBPIN: 0x 247066C1 |
|
|
|
|
|
Re: Restrict a client port-forward to 1 port
by Joseph Spenner
::
Rate this Message:
|
|
|
Re: Restrict a client port-forward to 1 port
by Adrya-2
::
Rate this Message:
|
|
|
Re: Restrict a client port-forward to 1 port
by Aarón Mizrachi
::
Rate this Message:
On Jueves 13 Agosto 2009 14:30:13 Joseph Spenner escribió:
> --- On Thu, 8/13/09, Adriana Rodean <adrya1984@...> wrote: > > Hi again, > > > > Maybe i didn't expressed myself right. > > I want client X to be able to connect with this command: > > ssh -L > > 30300:localhost:8080 -R 1037:localhost:55555 > > Client Y to be able to connect with: ssh -L > > 30300:localhost:8080 -R > > 1038:localhost:55555 > > and so on > > but client Y should be forbidden to connect with: ssh > > -L > > 30300:localhost:8080 -R 1037:localhost:55555 > > From what I can tell, your goal is to restrict certain REMOTE port forward > values. I do not think it is possible to place restrictions on REMOTE port > forwards if port forwarding is enabled in sshd_config. In the > authorized_keys, you can list 'permitopen' options, but this only applies > to LOCAL port forwards. local. In normal configuration possibilities, as Joseph said, there is no any possible _simple_ option that i can see. what i see: - iptables won't be useful on such case, yes, openssh will open this port with a process owned by your specific user, but, "-m owner" only applies for OUTPUT and POSTROUTING chains. What you need is for INPUT chain. - Internal openssh configuration does not provide you any way to limit what port are allowed to open by an specific user. Only for outgoing connections you can see limits, and you can do it without rsa/dss/... certificates using "Match User" directive on sshd_config --- But there are other useful possibilities... More complex obviously. I will not specify exactly how you can use it, but, hope it helps. LEVEL: MED. EFFICIENCY: LOW 1. Monitor/event script, this script will do something like: kill -9 $(netstat -anpo | grep ^tcp | grep LISTEN | cut -d"/" -f1 | cut -d: - f2,3 | awk '{printf("echo -n \"%s \"; ps -p %s uh\n",$1,$4);}' | bash | awk '{printf("%s %s %s\n",$1,$2,$3);}' | grep unmanarc | grep -v ^1234 | cut -d' ' -f3) where unmanarc is the username wanted, and the 1234 the port that you allow for him. Event will result in system detriment because each bind will launch this command, and even both mechanisms will allow the port binding for a short period of time until the script runs... LEVEL: MED. EFFICIENCY: MED 2. similar script but creating a dynamic rule on iptables, by default every port are restricted, when the script detects a match (username-port), the script will open an INPUT rule allowing this port. In reverse, the port will be completely useless. This script have to have special mechanism to detect when you close the SSH, and close the iptables rule too (-D). But... This mechanism is prone to a race condition. An attacker could simply LEVEL: HIGH. EFFICIENCY: HIGH 3. Possibly, the most feasible option: SELinux. It's possible to enforce a policy defining specials _port_t labels, and restricting specific users domains to bind only on labeled ports on the program domain. For that, previously, you have to add to selinux the specific unix accounts to these user domains. LEVEL: HIGH. EFFICIENCY: HIGH 4. LD_PRELOAD Method. LD_PRELOAD method will enable you to create a wrapper for bind. This wrapper could check for "getuid();" and check if a port/user are allowed. This database could be hardcoded or could exist in some specific file. ---------------- My recommendation: if you really need an efficient mechanism, try with selinux or ld_preload, if you don't, try with scripts. ;-) -- Ing. Aaron G. Mizrachi P. http://www.unmanarc.com Mobil 1: + 58 416-6143543 Mobil 2: + 58 424-2412503 BBPIN: 0x 247066C1 |
|
|
Re: Restrict a client port-forward to 1 port
by Joseph Spenner
::
Rate this Message:
|
|
|
|
signature.asc (205 bytes) 
| Free embeddable forum powered by Nabble | Forum Help |
