I've got an idea for using OpenSSH to establish a sort of internal
secure network, where everything going back and forth between certain
services (i.e. MySQL, how horrid) is encrypted even if the
application/server doesn't support launching the service over SSL. This
has some issues; so I'm probing for ideas on a new feature that would
resolve them and make this easier.
Let's hypothesize that you have 100 database servers serving MySQL
(TCP:3306) and MS SQL 2005 (TCP:1433). These are as follows:
10.10.30.[50-100]:3306 - MySQL
10.10.40.[75-125]:1433 - MS SQL 2000/2005
To deal with this, you set up on each machine 100 virtual network
adapters that don't route outside:
192.168.30.[50-100] - 10.10.30.[50-100] mates
192.168.40.[75-125] - 10.10.40.[75-125] mates
Now you run ssh as follows. In this example, the local IP is
10.10.10.20 (can probably omit -b). Also we use private key
authentication so no pasword:
i=50;
while [ "$i" != "101" ]; do
ssh -b 10.10.10.20 -L 192.168.30.${i}:3306:localhost:3306 &
i=$(( $i + 1 ))
done
i=75;
while [ "$i" != "126" ]; do
ssh -b 10.10.10.20 -L 192.168.40.${i}:3306:localhost:1433 &
i=$(( $i + 1 ))
done
The obvious problem here: We have some weird script bringing up 100 ssh
clients with 100 connections. What if we could tell ssh to load a file
and do it, where the file contained something like:
# Set default authentication
default auth=privkey:/home/sshfwd/.ssh/id_rsa user=sshfwd
# listen (-L; listen-dynamic is -D)
# nmap syntax for addresses (i.e. 192.168.1-20.35-123)
# MySQL servers
listen bind=10.10.10.20 listen-address=192.168.30.50-100 \
listen-port=3306 forward-address=localhost forward-port=3306
# MS SQL 2000 and 2005 servers
listen bind=10.10.10.20 listen-address=192.168.40.75-125 \
listen-port=3306 forward-address=localhost forward-port=1433
This file would only contain "listen" and "listen-dynamic"
lines; define
the four parameters to -D or -L; a bind address (-b); and a remote user.
default authentication is privkey, followed by gssapi; or specified on
a 'default' line. Same with 'user='.
Addresses and ports would be specified as they are in nmap, with
comma-separated sets and hyphen-separated ranges.
Another useful feature that would compliment this would be reverse
binding, i.e. connecting out to a remote server and forwarding
connections to an IP address on it to the local host; this would allow
for a high-security server to have a privkey, connect out to servers
with the pubkey, and then allow them to forward ports into it onto its
local host. This is a thousand times better than putting the privkey
freaking everywhere because one root-level compromise spells doom. This
feature could have the policy listen-r, with the command switch "-L
r:bind_addr:port:host:hostport" or some such craziness.
Not sure.. anyone have any thoughts?
--
We will enslave their women, eat their children and rape their
cattle!
-- Bosc, Evil alien overlord from the fifth dimension
Anti-Spam: https://bugzilla.mozilla.org/show_bug.cgi?id=229686