LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 10-16-2008, 09:45 AM   #1
cejennings_cr
LQ Newbie
 
Registered: Jul 2006
Posts: 5

Rep: Reputation: 0
SSH Gateway (not just forwarding) with command logging - can it be done?


I want to create a bastion host between a corporate network and a network management network that would look like the following:
  • User A uses PuTTY to connect to Bastion Host on TCP/2001 (ssh listening here) and the bastion host redirects to a Telnet (TCP/23) connection to old non-ssh capable device (Host X).
  • All commands that User A issues is recorded on the bastion host (psacct)
  • User B uses PuTTY to connect to Bastion Host on TCP/2002 (same ssh process as above is also listening here) and the bastion host redirects to a Telnet (TCP/23) connection to old non-ssh capable device (Host Y).
  • All commands that User B issues is recorded on the bastion host (psacct)

It would be real nice to have a simple configuration file that just says:
  • Bastion Host port 2001 = remote host X port 23
  • Bastion Host port 2002 = remote host Y port 23
  • User A authorized Host X & Host Y
  • User B authorized Host Y only.

Anyone know of anything that does this? If so, or have any ideas - would greatly appreciate.
 
Old 10-16-2008, 11:09 AM   #2
slimm609
Member
 
Registered: May 2007
Location: Chas, SC
Distribution: slackware, gentoo, fedora, LFS, sidewinder G2, solaris, FreeBSD, RHEL, SUSE, Backtrack
Posts: 430

Rep: Reputation: 67
You could just use a script to do something similar but run it on the same port.

make 2 groups
Group A id=1001
Group B id=1002


Code:
#!/bin/bash

#trap any type of escape chars.
trap '' 1 2 3 4 5 6 9 15 19 20

id -G | grep 1001
GROUPA=`echo $?`

if -G | grep 1002
GROUPB=`echo $?`

userdc() {
kill -9 `ps | awk '{ print $1}'` > /dev/null 2>&1
}

if [ "X$GROUPA" == "X0" ]; then
 while [ true ]; do
      echo "Please make a selection ( 1 2 3)"
      echo "1. Telnet Host X"
      echo "2. Telnet Host Y"
      echo "3. Exit"
      read ANSWER
           if [ "$ANSWER" == "1" ]; then
                telnet x.x.x.x 
           elif [ "$ANSWER" == "2" ]; then
  	  telnet y.y.y.y 
           elif [ "$ANSWER" == "3" ]; then
  	userdc
           else
              echo "not a vaild selection.  Try again"
           fi

  done
elif [ "X$GROUPB" == "X0" ]; then
while [ true ]; do
   echo "Please make a selection ( 1 2 )"
   echo "1. Telnet Host Y"
   echo "2. Exit"
   read ANSWER
           if [ "$ANSWER" == "1" ]; then
                telnet y.y.y.y
           elif [ "$ANSWER" == "2" ]; then
  	userdc
           else
              echo "not a vaild selection.  Try again"
           fi
  done
else 
 #DC the user... No questions asked
 userdc
fi

havent tested it but something similar should do the job.

then just call it from

/etc/bashrc
 
Old 02-09-2017, 10:27 PM   #3
TashiDuks
Member
 
Registered: Sep 2010
Posts: 54

Rep: Reputation: 0
Quote:
Originally Posted by cejennings_cr View Post
I want to create a bastion host between a corporate network and a network management network that would look like the following:
  • User A uses PuTTY to connect to Bastion Host on TCP/2001 (ssh listening here) and the bastion host redirects to a Telnet (TCP/23) connection to old non-ssh capable device (Host X).
  • All commands that User A issues is recorded on the bastion host (psacct)
  • User B uses PuTTY to connect to Bastion Host on TCP/2002 (same ssh process as above is also listening here) and the bastion host redirects to a Telnet (TCP/23) connection to old non-ssh capable device (Host Y).
  • All commands that User B issues is recorded on the bastion host (psacct)

It would be real nice to have a simple configuration file that just says:
  • Bastion Host port 2001 = remote host X port 23
  • Bastion Host port 2002 = remote host Y port 23
  • User A authorized Host X & Host Y
  • User B authorized Host Y only.

Anyone know of anything that does this? If so, or have any ideas - would greatly appreciate.
Hi,

I am also looking for similar kind of solution for my bastion host. I too posted on same topic (https://www.linuxquestions.org/quest...on-4175599413/) and waiting for someone to response.

Since you have already face similar issue. Would you mind to share me about the solution if you dont mind?

It would really help me.

Thanks
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
ssh command logging jcookeman Linux - Security 3 08-26-2008 02:50 AM
logging, remote ssh, scripts, and the at command gctaylor1 Programming 4 01-29-2007 08:22 AM
[SSH] Issue logging in [SSH & Permissions] MD3 Linux - Networking 11 12-10-2006 09:25 AM
ssh port forwarding command crimsontide Linux - Networking 1 10-18-2006 10:20 AM
Gateway not forwarding movitto Linux - Networking 5 09-06-2005 03:22 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 12:29 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration