Hi,
I have a daemon process which is changings things in the system only the
superuser should be allowed to change. Lets call it "riskyd".
Users use a frontend on the same machine (lets call it "risky"). risky
is a SUID program which talks to riskyd by binding to a privileged port,
then connecting to riskyd on localhost. riskyd cheks that the connection
is coming from localhost and from a privileged port to make sure the
partner is privileged.
Now - as an addition - I need connections from the network to riskyd
too. These connections must be tunneled through a secure connection.
The idea was to start something like
my_host: # ssh -R riskyd_port:localhost:riskyd_port -N other_host
This way the spawned sshd on other_host would listen() on riskyd's port,
incoming connections are tunneled to my_host (the host riskyd is running
on) and ssh makes a connection to the real riskyd on localhost
(my_host).
Some lousy ascii art:
my_host other_host
riskyd
^
| secure tunnel through network
ssh ===================================== spawned sshd
^
|
risky
Now from the users point of view it looks like riskyd is running on
other_host too: they can use risky, risky can connect to
localhost:riskyd_port. But in this case the real action is done on
my_host. riskyd still sees connections from localhost. So far, so good.
But: sshd on other_host will happily accept connections from non-
privileged ports, ssh will connect from a non-privileged port to
localhost. No way to check if the originating connection was from a
privileged port.
How could this be forced? I did not find any parameters ...
A stroll through the sources did not reveal something relevant (well, at
least not to me :-) so it seems not to be implemented yet.
Actually, remote forwarding is negotiated within some protocol between
ssh and sshd. No problem to change this slightly with a private patch.
If it only wouldn't incompatibly change the protocol.
So my idea is to implement it in a way that
client_request_forwarded_tcpip() in clientloop.c checks originator_port
for being in the priveleged range and - if yes - uses a privileged port
to connect.
Any comments?
Regards,
Robert
--
Robert.Dahlem at siemens.com
Siemens Business Services - SBS D ORS FS BO DEZ KORDOBA-Outsourcing
Tel: +49-69-797-6530 Fax: +49-69-797-6599
----------------------------------------------------------------------
Sent using PMMail (http://www.pmmail2000.com) - fast, decent, email
software; far better than Outlook. Try it sometime.