View source for HowTo Limit Remote Access To "ssh" Connections

= Overview =

In order to increase operational security, it is desirable to limit the remote access points into a system, and to either disable the use of insecure protocols (such as X or VNC), or to wrap these insecure protocols within a secure networking layer such as a ''ssh tunnel'' or VPN.

The goal of this "HowTo" is to:

* Demonstrate how to disable port 443 (https) thus limiting access to the NST system to port 22 (ssh).

* Securely access the NST WUI using a ssh tunnel through port 22.

* Securely run X applications across a ssh tunnel through port 22.

* Securely run a VNC session across a ssh tunnel through port 22.


= Disabling Remote HTTPS Access =

The following commands will disable the ''httpd'' service from listening on port 443 for remote connections:

 cd /etc/httpd/conf.d
 mv ssl.conf ssl.conf.disable
 service httpd restart

After running the above command, you should be able to use the '''netstat''' command to verify that port 443 is no longer open.

 [root@dhcp150 conf.d]# netstat -tunap
 Active Internet connections (servers and established)
 Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
 tcp        0      0 127.0.0.1:80                0.0.0.0:*                   LISTEN      2758/httpd          
 tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1451/sshd           
 tcp        0      0 192.168.20.201:22           192.168.20.2:49514          ESTABLISHED 2710/0              
 tcp        0      0 :::22                       :::*                        LISTEN      1451/sshd           
 udp        0      0 0.0.0.0:68                  0.0.0.0:*                               1222/dhclient       

The above output indicates that port 22 is the only IP4 TCP port that is listening for outside connections (''0.0.0.0:22'' in the ''Local Address'' column).

You can verify that the NST system is no longer allowing remote access to the web server by trying to connect to ''https://192.168.20.201/'' (change the IP address to match the address of your NST system). The connection should be refused.

= Using "ssh" To Access The System =

The command shown below will establish a ''ssh'' connection (through port 20) to the NST system having the IP address of ''192.168.20.201'':

 ssh -X -L 8000:127.0.0.1:80 -L 5806:127.0.0.1:5806 -L 5906:127.0.0.1:5906 root@192.168.20.201

The command line shown enables secure access to the following:

* Launching X based applications (such as firefox) on the NST system ('''-X''' option: Enables X11 forwarding) and having them display on your system (your system must be running a X server).
* Access to the NST WUI via: http://127.0.0.1:8000 ('''-L 8000:127.0.0.1:80''' option).
* Access to a NST VNC session via: http://127.0.0.1:5806 (you'll need to setup the VNC session first).
* Access to a NST VNC session via: ''vncviewer 127.0.0.1:6''

In order to avoid a lot of typing, the information about can be added to your ''~/.ssh/config'' file as a host entry.

 HOST nst-tunnels
 # Change to IP address of your NST system
 HostName=192.168.20.201
 User=root
 ForwardX11=yes
 # Tunnel access to NST WUI
 LocalForward=8000 127.0.0.1:80
 # Tunnel access to VNC web server for display :6 (optional)
 LocalForward=5806 127.0.0.1:5806
 # Tunnel access to VNC for display :6 
 LocalForward=5906 127.0.0.1:5906
 # Add following if you will be running a VNC listener on your client system
 # NOTE: Only one client connection will be able to claim port 5500 on the NST system
 RemoteForward=5500 127.0.0.1:5500

Once the configuration has been created, you can simply run:

 ssh nst-tunnels

== Accessing The NST WUI Through The SSH Tunnel ==

Once you've established the ''ssh connection'', accessing the NST WUI is simple, simply point your browser at the following link and login as you normally would.

http://127.0.0.1:8000/

== Running X Window Applications Through The SSH Tunnel ==

=== Requirements ===

In order to project ''X'' applications from the remote NST system back to your system, your system must be running a ''X'' server.

; Linux Clients
: You simply need to log into a ''X'' desktop environment (GNOME, KDE, Xfce, Fluxbox, ...). Open up a Terminal and ''ssh'' to your NST system.

; Mac OSX
: You simply need to log in, support for launching ''X'' applications is built in. Open up a Terminal and ''ssh'' to your NST system.

; Windows
: This is a bit more difficult, you will need to setup a ''X'' server. We suggest that you visit the http://www.cygwin.com/ site for details on setting up a ''X'' environment under Windows.

It should be noted, that since the ''X'' applications are being tunneled via ''ssh'', they appear as though you are running a local ''X'' application within your desktop environment. What this means is that your system does NOT need to be configured to permit direct TCP connections to the ''X'' server. Also, you don't need to worry about the ''xhost'' command as the applications will appear as local applications to your ''X'' server.

=== Verifying X Connection ===

When you established your ''ssh connection'' by logging into the NST system using '''ssh''', a secure tunnel was established such that your client system can be used as the ''X'' server for applications launched on the NST system (when you run something like ''firefox'' on the NST system, the actual application will appear on your client machine).

To verify that ''X'' support was enabled, echo the value of your ''DISPLAY'' environment variable as shown below:

 [root@dhcp150 ~]# echo $DISPLAY
 localhost:10.0

This indicates that the ''ssh connection'' is listening for connections to port ''6010'' on ''localhost'' and forwarding these connections back to the ''X'' server on your system. You can use the '''netstat'' command to verify this:

 [root@dhcp150 ~]# netstat -tunap | grep 6010
 tcp        0      0 127.0.0.1:6010              0.0.0.0:*                   LISTEN      2798/0              
 tcp        0      0 ::1:6010                    :::*                        LISTEN      2798/0        

''NOTE'': The display chosen will vary. In the above example, display ''10'' (port 6010) was chosen, but this can change.

=== From The Command Line ===

Running a ''X'' application through the tunnel from the command line is trivial. You simply run the command that you would like to have projected from the NST system back to your system. For example, to bring up a '''xterm''', you simply run the following from your ''ssh'' login prompt:

 [root@dhcp150 ~]# xterm &
 [1] 3040
 [root@dhcp150 ~]# 

If things are working correctly, it really is this simple and you should see a '''xterm''' appear on your desktop.

=== From The NST WUI ===

If you would like to use the NST WUI to launch ''X'' applications, it involves the following steps:

* Determining what the ''DISPLAY'' variable should be set to for your NST WUI session.
* Setting the ''DISPLAY'' variable for your NST WUI session.

To determine the what the ''DISPLAY'' should be set to, run the following command from your ''ssh connection'':

 [root@dhcp150 ~]# echo $DISPLAY
 localhost:10.0

To set the DISPLAY variable for your NST WUI session:

* Select the ''X|Launch X Window Application'' page from the menu bar on the NST WUI interface. This should take you to the page: http://127.0.0.1:8000/nstwui/cgi-bin/server/x.cgi (this link should work as well if you configured your ''ssh connection'' as recommended above).

* You should see a table near the top of the page where the first row is labeled: ''X Window Application''. In the second column, click on the ''xterm'' link following the ''Action:'' label to fill in a test ''X'' application to launch. 

* On the second line of the table, fill in the value of your ''DISPLAY'' environment variable (''localhost:10.0'' in this example, but yours may be different).

* Click on the ''Launch X Window Application'' button underneath the table.

If everything is working properly, a ''xterm'' should appear on your system that is running on the NST system. You can close out the ''xterm'' at this point (we were just using it to verify the connection was configured properly).

Now that the connection is configured properly, you should be able to launch the numerous ''X'' based applications found under the ''X'' option on the NST WUI menu bar (for example: ''X|Security Applications|ZenMap (Nmap GUI)'').

== Connecting To A VNC Desktop Through The Tunnel ==

=== Setting Up A Secure VNC Session ===

Using the NST WUI, select ''System|Virtual Computing|VNC Server Session Management'' from the menu bar. This should take you to: http://127.0.0.1:8000/nstwui/cgi-bin/server/vnc.cgi

The VNC setup table can be a bit overwhelming (there are a lot of options you can play with). For this example, the key settings are:

* The display number should be set to ''6'' to agree with the tunnels we setup above (this should be the default display the first time you set up a VNC connection).

* On the ''TCP Connections'' line, make sure the ''Local Only / Secure SSH Tunnel'' radio button is selected (it is not by default). If you don't select this option, then the NST system will expose ports 5806 and 5906 to the outside world and we don't want it to in this secure setup.

* On the ''TCP Connections'' line, it is recommended that you leave the ''Enable:  X TCP/IP'' and ''Enable:  xhost +'' disabled (unchecked).

* Feel free to set the other options how they best suit your needs (screen size, desktop environment, etc).

Once the settings have been specified, you can press the ''Start VNC Server'' button that is just under the settings table.


=== Connecting Securely Using A Native VNC Client ===

Now that you've setup a VNC server as display '':6'' on the system, you should be able to connect to it using any native VNC client (vncviewer, UltraVNC, TightVNC, TigerVNC, Chicken Of The VNC, ...) by pointing your VNC viewer at: ''127.0.0.1:6'' (or ''127.0.0.1:5906'' if your native viewer wants to see the full TCP port to connect to).

=== Connecting Securely Using The VNC Web Server ===

You should also be able to connect to the VNC server using the VNC viewer applet by pointing your Java enabled web browser at: http://127.0.0.1:5806/.

=== Connecting Securely Using A VNC Listener ===

If you are running a VNC listener on your system and you enabled the ''reverse ssh tunnel'' as shown in the sample ''~/.ssh/config'' file entry, you should be able to connect the NST's VNC desktop to your system using the following steps:

* Select ''System|Virtual Computing|VNC Server Session Management'' from the menu bar. This should take you to: http://127.0.0.1:8000/nstwui/cgi-bin/server/vnc.cgi

* You should see a table of ''Active VNC Server NST Desktop Sessions'' running on the NST system. Locate the row labeled ''(Local Only):6'' and press the corresponding ''Connect'' button under the ''Actions'' column. 

* The VNC desktop should automatically appear on your system.