Subject: [fwtk-users] Re: ssh setup

From: Michel Bardiaux <[email-masked]>
Date: Tue, 04 Dec 2001 11:07:55 +0100

lebayle wrote:
> 
> Hi,
> 
> I would like to setup the already mentioned ssh setup as follows:
> ssh client ---> crypted  ---> firewall
>                               sshd (-rsh launches telnet localhost)
>                                 |
>                                 V
>                               tn-gw ---> uncrypted ---> internal host
> 
> The aim is to avoid passwords in clear text on the Internet.
> Everything works fine, but I would like to avoid passwords for logging into
> the firewall since the actual password check is done with the internal host
> instead.
> I could not find a way to avoid this, any idea from someone who implemented
> this ?
> 
> Thanks,
> Bruno LEBAYLE ([email-masked])
> European Synchrotron Radiation Facility - Grenoble, FRANCE
> 
Why would you want to do things like that? It brings telnet and rsh into
play, involves cleartext traffic between the firewall and the internal
host, and requires the ssh keys to be on the firewall, where they are
harder to administrate. We use the following setup:

ssh client ---> crypted ---> firewall
                             plug-gw
                                |
                                V
                             internal host
                               sshd

The drawback is that it gives you access to only *one* internal host.
But hopping from there using rsh is not so much of a risk. (I tend to
favor rsh with .rhosts access control, to avoid cleartext password
traffic even on the internal net. If you do not trust your internal net,
you could use ssh there as well)

HaND
-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]