Subject: Re: plug-gw + ssh config question

From: "Davis, Ricardo C." <[email-masked]>
Date: Fri, 13 Apr 2001 12:34:29 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello, everyone.

After reading the thread on this message and the earlier discussion (Re:
ssh-gw?)  I set out to add the ability to ssh from the Internet to an SSH1
server (long story here) on the intranet.

On this RH Linux box (fwall) I modified the services, inetd.conf, and
netperm-table files:

[services]
ssh             22/tcp          # SSH remote login

[inetd.conf]
ssh     stream tcp      nowait     root /usr/local/etc/netacl ssh

[netperm-table]
# Plug-gw rules:
# --------------
netacl-ssh:     permit-hosts * -exec /usr/local/etc/plug-gw ssh
plug-gw:        port ssh * -plug-to 192.168.0.50 -port 22

I fired up my OpenSSH 2.5.2p2-1 ssh client on an external box:

$ ssh -l [email-masked] -o "Protocol 1" -v -v -v fwall
OpenSSH_2.5.2p2, SSH protocols 1.5/2.0, OpenSSL 0x0090581f
debug1: Seeding random number generator
debug1: Rhosts Authentication disabled, originating port will not be
trusted.
debug1: ssh_connect: getuid 302 geteuid 0 anon 1
debug1: Connecting to fwall [....] port 22.
debug1: Connection established.
ssh_exchange_identification: Connection closed by remote host
debug1: Calling cleanup 0x80605a0(0x0)
$

On fwall, the following messages were logged in /var/log/messages:

Apr 13 12:21:16 proxy netacl[29063]: permit
host=ftp2.abnbilling.com/209.48.180.234 service=ssh
execute=/usr/local/etc/plug-gw
Apr 13 12:21:16 proxy plug-gw[29063]: deny
host=ftp2.abnbilling.com/209.48.180.234 service=ssh

This looks similar to the problem Georg was having.  Did I mess up the
plug-gw configuration?

-Ricardo 

----Original Message----
From: Georg Wittig <[email-masked]> 
Subject: Re: plug-gw + ssh config question 
Date: 2001-01-09 14:21:03

My problem is solved in the meantime. Thanks to all who helped me. I
had made 2 errors: First, I had made a typo in my netperm-table
("permit hosts" instead of "permit-hosts"). Second, I found I had used
a hand-edited plug-gw; as soon as I replaced it by plug-gw of the
official version 2.1, everything worked fine.

Blush. Sorry for all the fuss.

For those who are interested in the final configuration, here's my
setup:

[/etc/services]
ssh             22/tcp                          # SSH Remote Login Protocol

[ps axww | grep ssh]
27055 tty1     S      0:00 /path/to/plug-gw -daemon ssh ssh
(I'm not running inetd, so I started plug-gw manually.)

[netperm-table]
ssh:	port ssh * -plug-to 11.22.33.44 -port ssh

----Original Message----
Subject: Re: ssh-gw? 
From: Michel Bardiaux <[email-masked]> 
Date: 2000-04-11 8:24:28

[To be removed from this list send the message "unsubscribe fwtk-users" in
the BODY of a mail message to [email-masked].]

Michael Thies wrote:
> > > is it possible, to leave a network protected by a tis-fw using ssh?
> In our company only a telnet-gw and a ftp-gw is installed. .-(
> And on the website http://www.tis.com/research/software/ I also didn't
> found anything about ssh.
> > Maybe one of You has a solution?
>  * INCOMING SSH:

We simply pass SSH through the FW with plug-gw, e.g.:
[/etc/services]
ssh             22/tcp                          # SSH Remote Login
Protocol
[/etc/inetd.conf]
ssh             stream  tcp     nowait  root   
/usr/local/fwtk/etc/netacl ssh
[/usr/local/fwtk/etc/netperm-table]
netacl-ssh: permit-hosts * -exec /usr/local/fwtk/etc/plug-gw ssh
plug-gw: port ssh * -plug-to aa.bb.cc.1 -port
22

(aa.bb.cc.1 is the IP address of the SSHD server on the internal net)

You also have to allow SSH through whatever filtering system is used on
the
machine at the DMZ/intranet boundary, but that's outside FWTK.

<pedantic> Of course, since you tunnel *any* SSH in, your SSH setup better
be
'military'
grade: large keys, and strict rules for public key management: long
passphrase,
public keys have to be carried on floppy and personnally handed to the
system
manager, etc... Basically, outside hosts become part of the internal
net, and
security policies for internal hosts must be applied to them. Even
stronger policies,
actually, since the outside hosts might *not* be protected by an FW.
</pedantic>  Something still worries me in that setup: what are the risks of
DoS
attacks on the
internal net? Ideas anybody?

* OUTGOING SSH

We have created an extra service on the FW for every destination
(including the
DMZ machines). The netperm-table rules read like:

netacl-ssh-XX: permit-hosts aa.bb.cc.* -exec /usr/local/fwtk/etc/plug-gw
ssh-XX
plug-gw: port ssh-XX aa.bb.cc.129 -privport -plug-to XX.XX.XX.XX -port
PPPP

(aa.bb.cc is our assigned Class-C, 129 is the IP address of the
Intranet/DMZ boundary
NIC)

All this is IMHO, of course. Critiques welcome!

Greetings.                                    
-- 
Michel Bardiaux

---

From: Rick Murphy <[email-masked]>
Date: Fri, 13 Apr 2001 14:24:40 -0400

># Plug-gw rules:

...

>This looks similar to the problem Georg was having.  Did I mess up the

Yes. Netacl fires up plug-gw as ssh; plug-gw looks for "ssh" rules and fails.
Try changing "plug-gw" to "ssh" on the second netperm-table line.

Why are you running netacl in front of plug-gw in this configuration? If 
you *always* run a plug-gw, just run it and don't bother with netacl.
         -Rick

---

From: Ted Keller <[email-masked]>
Date: Sat, 14 Apr 2001 07:56:20 -0400 (EDT)

Richardo,

I assume that you are using the verion 2.1 of plug-gw.  Change your
netperm-table to

ssh:	port ssh * -plug-to 192.168.0.50 -port 22

note - you also may want to restrict a bit more who can connect....

ted keller