Subject: ssh-gw?

From: Michael Thies <[email-masked]>
Date: Tue, 11 Apr 2000 01:16:22 +0200

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi You all,

is it possible, to leave a network protected by a tis-fw using ssh?
In our company only a telnet-gw and a ftp-gw is installed. .-(
And on the website http://www.tis.com/research/software/ I also didn't
found anything about ssh.

Maybe one of You has a solution?

TiA
-- 
\o/ 
Michael Thies                  ---                  [email-masked]

Das Englische ist eine einfache, aber schwere Sprache. Es
besteht aus lauter Fremdwörtern, die falsch ausgesprochen
werden.
                                             Peter Panter

---

From: Michel Bardiaux <[email-masked]>
Date: Tue, 11 Apr 2000 10:24:28 +0200

> Maybe one of You has a solution?

* INCOMING SSH:

We simply pass SSH through the FW with plug-gw, e.g.:
[/etc/services]
ssh             22/tcp                          # SSH Remote Login
Protocol
[/etc/inetd.conf]
ssh             stream  tcp     nowait  root   
/usr/local/fwtk/etc/netacl ssh
[/usr/local/fwtk/etc/netperm-table]
netacl-ssh: permit-hosts * -exec /usr/local/fwtk/etc/plug-gw ssh
plug-gw: port ssh * -plug-to aa.bb.cc.1 -port
22                                                                              
(aa.bb.cc.1 is the IP address of the SSHD server on the internal net)

You also have to allow SSH through whatever filtering system is used on
the
machine at the DMZ/intranet boundary, but that's outside FWTK.

<pedantic>
Of course, since you tunnel *any* SSH in, your SSH setup better be
'military'
grade: large keys, and strict rules for public key management: long
passphrase,
public keys have to be carried on floppy and personnally handed to the
system
manager, etc... Basically, outside hosts become part of the internal
net, and
security policies for internal hosts must be applied to them. Even
stronger policies,
actually, since the outside hosts might *not* be protected by an FW.
</pedantic>

Something still worries me in that setup: what are the risks of DoS
attacks on the
internal net? Ideas anybody?

* OUTGOING SSH

We have created an extra service on the FW for every destination
(including the
DMZ machines). The netperm-table rules read like:

netacl-ssh-XX: permit-hosts aa.bb.cc.* -exec /usr/local/fwtk/etc/plug-gw
ssh-XX
plug-gw: port ssh-XX aa.bb.cc.129 -privport -plug-to XX.XX.XX.XX -port
PPPP

(aa.bb.cc is our assigned Class-C, 129 is the IP address of the
Intranet/DMZ boundary
NIC)

All this is IMHO, of course. Critiques welcome!

Greetings.                                    
-- 
Michel Bardiaux

---

From: [email-masked]
Date: Tue, 11 Apr 2000 15:16:43 +0400

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

> Maybe one of You has a solution?

There are several ones. I am thinking about writing new ssh-gw (my old
one is damn ugly hack) but i don't have time for it now :(

BTW fwtk/gauntlet comparison from the page above is long out of date in
both parts..
                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

---

From: Michel Bardiaux <[email-masked]>
Date: Tue, 11 Apr 2000 14:33:31 +0200

> BTW fwtk/gauntlet comparison from the page above is long out of date in
As you can see from my own reply to the OPs query, we use SSH a lot, so
I'm
quite interested. So lotsa questions...

- I thought an ssh-gw was in principle impossible since the session is
supposed
to be encrypted so totally opaque. 

- What are the advantages of an ssh-gw over plain good old
plug-gw?

- Can you give me an URL for the code, or mail it to me?

- Any critiques on my previous reply to the OP? 

TIA.
-- 
Michel Bardiaux
UsrConsult S.P.R.L.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10

---

From: [email-masked]
Date: Tue, 11 Apr 2000 18:44:38 +0400

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

> to be encrypted so totally opaque. 

So firewall has to know how to decrypt both ends and perform some kind of
key spoofing. Some people consider that as bad idea, but it is useful
sometimes.
 
> - What are the advantages of an ssh-gw over plain good old

More flexibility and ease of use. plug-gw has fixed end-to-end
configuration, that means you can ssh to just one server outside and to
just one server inside or play with port numbers.
 
> - Can you give me an URL for the code, or mail it to me?

The hack i was talking about was created to accept incoming ssh connections
and pass them via telnet to a trusted LAN.

There was a thing that looked more like ssh proxy, posted here on the list.

                                     _     _  _  _  _      _  _