Subject: plug-gw + ssh config question

From: Georg Wittig <[email-masked]>
Date: Fri, 5 Jan 2001 15:04:16 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi,

I need some help to get ssh proxied to the internal net via plug-gw. I
searched the list archives and tried my setup according to the article
	http://marc.theaimsgroup.com/?l=fwtk-users&m=95544510922458&w=2
by Michel Bardiaux. But alas, this doesn't work for me. My firewall
machine is running RedHat-6.2.

Here's my current setup:

[/etc/services]
ssh             22/tcp                          # SSH Remote Login Protocol

[ps axww | grep ssh]
27055 tty1     S      0:00 /path/to/netacl -daemon 22 ssh
(No, I'm not running inetd, so I started netacl manually.)

[netperm-table]
netacl-ssh:     permit hosts * -exec /path/to/plug-gw ssh
plug-gw:        port ssh * -plug-to 11.22.33.44 -port ssh

When I try an inbound ssh connection, the connection is closed
immediately. In /var/log/messages I just see the line

	netacl[27080]: deny host=55.66.77.88s service=ssh

Why's that? Doesn't the "netacl-ssh" line in my netperm-table *allow*
that connection? What did I do wrong?

Thanks for your help,
      Georg

-- 
Georg Wittig, GMD				[email-masked]
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Du hast keine Spracherkennung installiert? Doch Komma aber Mai Stenz
Macht Sie den um Gang mit dem Juice nett auch nicht leichter.

---

From: Charles Robinson <[email-masked]>
Date: Fri, 5 Jan 2001 10:23:21 -0500 (EST)

1. Have you tried using the ssh-gw from the toolkit?
2. Did you add your client ip to your hosts.allow file?

~~~~~~~~~~~~~~~~
Charles Robinson
    IT Dept.
Professional Examination Service
~~~~~~~~~~~~~~~~

---

From: Georg Wittig <[email-masked]>
Date: Sat, 6 Jan 2001 20:50:40 +0100

> 1. Have you tried using the ssh-gw from the toolkit?

No, I think we cannot use ssh-gw because it is a patch to a VERY old
version of sshd (1.2.20). I doubt it can be applied successfully to
ssh-2.3 or ssh-2.4 or openssh. Furthermore, data is not encrypted
between the gateway and the ssh Server.

> 2. Did you add your client ip to your hosts.allow file?

Yes, the client is allowed in /etc/hosts. But tcpwrapper is not
involved in that business at all; inetd isn't running. The tcpwrapper
message would have been "refused connection from ...". But the message
I see is "deny host=... service=ssh" which can be found in netacl.c.
So I think it is a problem with netacl.

---

From: Ted Keller <[email-masked]>
Date: Sat, 6 Jan 2001 17:26:01 -0500 (EST)

Georg,

A couple of things here.  First, the format if the netacl netperm entry
should be something like....

netacl-ssh: permit-hosts xxx.xxx.xxx.* -exec /usr/sbin/plug-gw ssh

I think you were getting the failure from netacl since it didn't see the
permit-hosts entry in the netacl line.

Next - then I think the netperm-entry for the plug-gw line (assuming you
are running version 2.1) should be....

ssh:        port ssh * -plug-to 11.22.33.44 -port ssh

Plug-gw now looks for the name of the service on the executing line and
look up that name for it's parameters.  This allows you to have different
parameters based on the type of plug.  Very handy if you want different
timeout values.

Now - before you go and implement everything - plug-gw can run in daemon
mode.  It has all of the checking required to limit by source host the
same as netacl.  Not sure what netacl brings to the picture - other than
additional complications in your rulesets.

ted keller

---

From: Hanko Zoltan <[email-masked]>
Date: Sat, 06 Jan 2001 01:31:59 -0000 (GMT)

On 05-Jan-2001 Charles Robinson wrote:
Hi All,
 > 1. Have you tried using the ssh-gw from the toolkit?
I have the same problem. I tried to do it earlier, but I couldn't. Because it is
a patch for ssh 1.x, isn't it?

In this case, have anybody a patched ssh source/binary for redhat 6.2? (I have
openssh at the moment.)
(Pls. send me URL, where I can download it.)

I read the ssh-gw doc.
I remember it support connection from inside to Internet.
If I'd like to connect from outside to a protected computer behind firewall, I
have to use plug-gw. But the only possible solution the one-one connection
(from outside to inside). The one-many isn't possible.
There is no real gw, like telnet-gw or ftp-gw.

Have anybody a working ssh-gw example? What I have to install? What are the
right config file settings? I'd like to ssh from outside to one or more inside
host. (I have a public ip addres on fw. The computers behind fw have only
internal ip address.)
(I'm using ip masqurading from inside to outside, so I haven't got problem with
ssh, at the moment. But is it safe?

Thanks in advance!

Zoli
----------------------------------
E-Mail: Zoltan Hanko <[email-masked]>
This message was sent by XFMail
----------------------------------

---

From: Georg Wittig <[email-masked]>
Date: Mon, 8 Jan 2001 15:14:58 +0100

> netacl-ssh: permit-hosts xxx.xxx.xxx.* -exec /usr/sbin/plug-gw ssh

Ahh, thanks to point out my typo. I should have typed "permit-hosts"
instead of "permit hosts". Well, now the "deny host=" message has
gone! yaba daba doo.

> ssh:        port ssh * -plug-to 11.22.33.44 -port ssh

Alas, that doesn't help me. The symptom remains: On machine A I type
"ssh gateway". Then the connection is terminated immediately without
an error message appearing on A. In the syslog of the gateway I now
see
	netacl[31408]: permit host=A service=ssh execute=/path/to/plug-gw

- nothing else, even if I include an additional netperm-table line
"ssh: permit-service ssh".

> additional complications in your rulesets.

This doesn't work for me. If I kill the netacl process and start
	/path/to/plug-gw -daemon 22 ssh
then the symptom remains: On machine A I type "ssh gateway". Then the
connection is terminated immediately without an error message
appearing on A. In the syslog of the gateway I now see - nothing!
(Currently I prefer the netacl way: netacl at least drops a line into
syslog, even if that ain't gonna help me. :-)

Anyone knows what's going on?

---

From: Berend De Schouwer <[email-masked]>
Date: Mon, 8 Jan 2001 17:23:13 +0200

> "ssh: permit-service ssh".

If you do a 'netstat -a' on the proxy, do you see any /attempts/
to connect to the far side.  Does the client send more than just
the SYN packet?  Can you do a network dump to find out if it sends
an ICMP response?

 > Anyone knows what's going on?

What does ssh -v spit out?

Kind regards,				  
Berend                                  

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Berend De Schouwer, +27-11-712-1435, UCS

---

From: Georg Wittig <[email-masked]>
Date: Tue, 9 Jan 2001 15:21:03 +0100

My problem is solved in the meantime. Thanks to all who helped me. I
had made 2 errors: First, I had made a typo in my netperm-table
("permit hosts" instead of "permit-hosts"). Second, I found I had used
a hand-edited plug-gw; as soon as I replaced it by plug-gw of the
official version 2.1, everything worked fine.

Blush. Sorry for all the fuss.

For those who are interested in the final configuration, here's my
setup:

[/etc/services]

[ps axww | grep ssh]
27055 tty1     S      0:00 /path/to/plug-gw -daemon ssh ssh
(I'm not running inetd, so I started plug-gw manually.)

[netperm-table]

---

From: Stanley Hopcroft <[email-masked]>
Date: Wed, 10 Jan 2001 21:09:42 +1100 (EST)

Dear Ladies and Gentlemen,

I am writing to ask your help applying the yao anti-spam patchs.

When I try and patch smap.c (either that from 2.0 or 2.1) the patch
program fails to recognise where it should start. Ignoring white space
doesn't help either.

hermes> patch < yao-smap.pch
Hmm...  Looks like a new-style context diff to me...
The text leading up to this was:
--------------------------
|*** smap.c.2.1  Fri May 22 13:31:00 1998
|--- smap.c      Tue Jun  9 14:21:39 1998
--------------------------
Patching file smap.c using Plan A...
patch: **** Overdue "---" at line 23--check line numbers at line 4
hermes> patch -F 3 < yao-smap.pch 
Hmm...  Looks like a new-style context diff to me...
The text leading up to this was:
--------------------------
|*** smap.c.2.1  Fri May 22 13:31:00 1998
|--- smap.c      Tue Jun  9 14:21:39 1998
--------------------------
Patching file smap.c using Plan A...
patch: **** Overdue "---" at line 23--check line numbers at line 4
hermes> 

I think that the original file (smap.c) is the correct version [1.22]

hermes> grep murphy smap.c
static  char    RcsId[] =
"$Header: /home/rmurphy/fwtk/fwtk/smap/RCS/smap.c,v 1.22 1998/01/13
22:56:06 rmurphy Exp $";
hermes> grep murphy yao-smap.pch 
  static        char    RcsId[] =
"$Header: /home/rmurphy/fwtk/fwtk/smap/RCS/smap.c,v 1.22 1998/01/13
 22:56:06 rmurphy Exp $";
  static        char    RcsId[] =
"$Header: /home/rmurphy/fwtk/fwtk/smap/RCS/smap.c,v 1.22 1998/01/13
 22:56:06 rmurphy Exp $";
hermes> 

The patch program has never failed me before. It's

hermes> patch -v
Patch version 2.1
hermes> uname -a
FreeBSD hermes.IPAustralia.gov.au 4.1-RELEASE FreeBSD 4.1-RELEASE
#0: Tue Oct 17 13:59:51 EST 2000
[email-masked]:/usr/src/sys/compile/HERMES  i386
hermes> 

Thank you very much for your help,

Yours sincerely.

S Hopcroft

IP Australia