LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-14-2001, 03:32 AM   #1
r3b00t
Member
 
Registered: May 2001
Distribution: OpenBSD 3.0-beta
Posts: 50

Rep: Reputation: 15

Hi,

I was playing with netfilter this weekend, when I decided to bind my sshd to localhost, and let netfilter redirect allowed trafic thru to localhost:22. This works now from the local box, but whenever I try to connect remotely, the connection times out...

Here's the stuff I did:


--[cut here]--------

root:/# cat > /dev/null << EOF
> ip1 == addr of eth0
> ip2 == addr of remote machine
> EOF
root:/# id
uid=0(root) gid=0(root) groups=0(root)
root:/# uname -a
Linux lacrima 2.4.4-work #1 Mon May 14 08:34:52 CEST 2001 i686 unknown
root:/# netstat -an|grep LISTEN
tcp 0 0 0.0.0.0:6000 0.0.0.0: * LISTEN
tcp 0 0 127.0.0.1:22 0.0.0.0: * LISTEN
unix 2 [ ACC ] STREAM LISTENING 1295 /tmp/.X11-unix/X0
root:/# lsmod
Module Size Used by
root:/# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
root:/# /sbin/iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
root:/# telnet localhost 22
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
SSH-1.99-OpenSSH_2.9p1
quit
Protocol mismatch.
Connection closed by foreign host.
root:/# telnet ip1
Trying ip1...
telnet: Unable to connect to remote host: Connection refused
root:/# /sbin/iptables -A INPUT -p tcp -d 127.0.0.1 --dport 22 -j ACCEPT
root:/# /sbin/iptables -A INPUT -p udp -d 127.0.0.1 --dport 22 -j ACCEPT
root:/# /sbin/iptables -A FORWARD -p tcp -d 127.0.0.1 --dport 22 -j ACCEPT
root:/# /sbin/iptables -A FORWARD -p udp -d 127.0.0.1 --dport 22 -j ACCEPT
root:/# /sbin/iptables -t nat -A PREROUTING -p tcp -d ip1 --dport 22 -j DNAT --to 127.0.0.1:22
root:/# /sbin/iptables -t nat -A PREROUTING -p udp -d ip1 --dport 22 -j DNAT --to 127.0.0.1:22
root:/# /sbin/iptables -t nat -A OUTPUT -p tcp -d ip1 --dport 22 -j DNAT --to 127.0.0.1:22
root:/# /sbin/iptables -t nat -A OUTPUT -p udp -d ip1 --dport 22 -j DNAT --to 127.0.0.1:22
root:/# iptables -L -n -v
Chain INPUT (policy ACCEPT 173 packets, 24900 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 127.0.0.1 tcp dpt:22
0 0 ACCEPT udp -- * * 0.0.0.0/0 127.0.0.1 udp dpt:22

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 127.0.0.1 tcp dpt:22
0 0 ACCEPT udp -- * * 0.0.0.0/0 127.0.0.1 udp dpt:22

Chain OUTPUT (policy ACCEPT 18 packets, 1018 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 127.0.0.1 tcp dpt:22
0 0 ACCEPT udp -- * * 0.0.0.0/0 127.0.0.1 udp dpt:22

Chain OUTPUT (policy ACCEPT 18 packets, 1018 bytes)
pkts bytes target prot opt in out source destination
root:/# iptables -L -n -v -t nat
Chain PREROUTING (policy ACCEPT 1494 packets, 210K bytes)
pkts bytes target prot opt in out source destination
4 256 DNAT tcp -- * * 0.0.0.0/0 ip1 tcp dpt:22 to:127.0.0.1:22
0 0 DNAT udp -- * * 0.0.0.0/0 ip1 udp dpt:22 to:127.0.0.1:22

Chain POSTROUTING (policy ACCEPT 93 packets, 5566 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 91 packets, 5446 bytes)
pkts bytes target prot opt in out source destination
2 120 DNAT tcp -- * * 0.0.0.0/0 ip1 tcp dpt:22 to:127.0.0.1:22
0 0 DNAT udp -- * * 0.0.0.0/0 ip1 udp dpt:22 to:127.0.0.1:22
root:/# lsmod
Module Size Used by
iptable_nat 14768 0 (autoclean) (unused)
ip_conntrack 13968 1 (autoclean) [iptable_nat]
iptable_filter 2080 0 (autoclean) (unused)
ip_tables 10368 4 [iptable_nat iptable_filter]
root:/# telnet localhost 22
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
SSH-1.99-OpenSSH_2.9p1
quit
Protocol mismatch.
Connection closed by foreign host.
root:/# telnet ip1 22
Trying ip1...
Connected to ip1.
Escape character is '^]'.
SSH-1.99-OpenSSH_2.9p1
quit
Protocol mismatch.
Connection closed by foreign host.
root:/# ssh r3boot@ip2
r3boot@ip2's password:
Last login: Tue May 1 06:23:52 2001 from x.x.x.x
OpenBSD 2.8 (conf) #4: Mon Mar 5 13:58:44 CET 2001

$ telnet ip1 22
Trying ip1...
telnet: connect to address ip1: Connection timed out
$ Connection to ip2 closed.
root:/#

---[done cut]------

I've read the 2.4 packetfilter and NAT HOWTO's from rusty, and this _should_ do the trick....

Anybody have a clue to how to fix this?

thanks, Lex
 
Old 05-24-2001, 10:40 AM   #2
raz
Member
 
Registered: Apr 2001
Location: London
Posts: 408

Rep: Reputation: 31
Hi r3b00t,

As no one has attempted to try and answer your question on forwarding internally to your localhosted sshd. "no idea why you would even attempt to do this"

Anyway I haven't used netfilter "yet" but I think I can see a flaw in your chains.

The PREROUTING chain does filtering on packets before they hit the routing tables that sends them onwards to the INPUT/FORWARD/OUTPUT chains.

In your input chains you need to allow access to your IP address not the local address.

Also switch on logging, on all connections so you can see which filters accept the connections.

Just a tip,
Raz
 
Old 05-24-2001, 11:33 AM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,409
Blog Entries: 55

Rep: Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582
In addition to that, the main thing is to NOT bind sshd to localhost, it can ONLY accept (listening to) traffic from localhost. No outside hosts may use localhost as a destination address in correct/legitimate traffic. (IANA stuff n such)

OTOH, if u wanna play u can try & setup a portforwarder on the external interface & see if u can bounce traffic off a port to reach localhost :-]
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Message from syslogd@localhost localhost kernel: Disabling IRQ #21 ylts Linux - Hardware 0 02-26-2005 09:01 AM
Enabling SSH in mandrake 9.2 - sshd vs. sshd-xinetd DogTags Linux - Newbie 7 11-25-2003 01:17 PM
dns requests from localhost to localhost keex Linux - Networking 2 11-13-2003 02:47 PM
What's the difference between Linux-NAT and Sygate-NAT? yuzuohong Linux - Networking 0 08-07-2002 05:07 AM
Redhat 7.2 and Redhat 7.3 NAT,Netfilter and Iptsable guanyu Linux - Networking 1 06-21-2002 08:38 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 09:27 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration