2012 - Debian 5 + SSH = SSH VPN Howto
The Slovak original of this document: 2012 - Debian 5 + SSH = SSH VPN Howto (slovensky).
SSH VPN - howto
Author : lala -> hajzer (at) gmail (dot) com
Date : 2012
====================================================================================================
====================================================================================================
Installing the SSH server inside the jail (chroot)
Note: taking the easier road (with debootstrap)
====================================================================================================
Create the directory the chroot environment needs
-------------------------------------------------
# mkdir -p /chroot/sshvpn
# CHROOT=/chroot/sshvpn
If we go through a proxy server, set the environment
----------------------------------------------------
# export http_proxy=http://192.168.21.1:8080
# export ftp_proxy=http://192.168.21.1:8080
[1] Nainstalujeme potrebny balicek "debootstrap"
[2] Start building the chroot environment
-------------------------------------------------
[1]# apt-get install debootstrap
[2]# debootstrap --arch i386 squeeze $CHROOT http://ftp.sk.debian.org/debian/
[1] Prepneme sa do chroot prostredia
[2] Nakonfigurujeme prompt prikazoveho riadku
[3] Nainstalujeme SSH server
[4] Zmenime heslo pre uzivatela "root"
----------------------------------------------
[1]# chroot $CHROOT /bin/bash --login
[2]# echo 'PS1="CHROOT-sshvpn:\w# "' >> ~/.bashrc
[3]# CHROOT-sshvpn:/# apt-get update
[3]# CHROOT-sshvpn:/# apt-get install ssh
[4]# CHROOT-sshvpn:/# passwd
[4]# CHROOT-sshvpn:/# exit
Create the start-up script for the SSHVPN server
------------------------------------------------
# nano /etc/init.d/chroot-sshvpn
---------------------------------------------
#!/bin/bash
CHROOT=/chroot/sshvpn
mount -t devpts devpts $CHROOT/dev/pts
mount -t proc proc $CHROOT/proc
chroot $CHROOT /etc/init.d/ssh start
---------------------------------------------
[1] Make the start-up script executable
[2] Set the SSH server in the chroot environment to start at boot
-----------------------------------------------------------------
[1]# chmod +x /etc/init.d/chroot-sshvpn
[2]# update-rc.d chroot-sshvpn defaults
Nainstalujeme a nakonfigurujeme potrebny balicek "locales"
----------------------------------------------------------
# chroot $CHROOT /bin/bash --login
CHROOT-sshvpn:/# apt-get install locales
CHROOT-sshvpn:/# dpkg-reconfigure locales
Set syslog-ng to log the auth events from the jail
--------------------------------------------------
# nano /etc/syslog-ng/syslog-ng.conf
-----------------------------------------------------------
source s_src_sshvpn { unix-dgram("/chroot/sshvpn/dev/log"); internal(); file("/proc/kmsg" program_override("kernel")); };
destination d_auth_sshvpn { file("/chroot/sshvpn/var/log/auth.log"); };
log { source(s_src_sshvpn); filter(f_auth); destination(d_auth_sshvpn); };
-----------------------------------------------------------
Restartujeme syslog-ng server
-----------------------------
# /etc/init.d/syslog-ng restart
For the time to be right inside the jail, put the file "localtime" into it
--------------------------------------------------------------------------
# cp /etc/localtime /chroot/sshvpn/etcConfiguring the SSH server inside the jail (chroot)
Prepneme sa do chroot prostredia
--------------------------------
# chroot $CHROOT /bin/bash --login
Creating the group "sshvpn", which holds the users who come in over SSH VPN
---------------------------------------------------------------------------
# groupadd sshvpn
Zoznam / mapovanie realnych uzivatelov na sshvpn ucty
------------------------------------------------------------
Ucet | Realny uzivatel | DSA key passphrase
------------------------------------------------------------
sshvpn1 | user1 | heslo_ku_klucu
sshvpn2 | user2 | heslo_ku_klucu
sshvpn3 | user3 | heslo_ku_klucu
Setting up the SSH daemon for SSH VPN
-------------------------------------
# nano /chroot/sshvpn/etc/ssh/sshd_config
-----------------------------------------
ListenAddress 192.168.21.130:1122
PermitRootLogin no
X11Forwarding no
Banner /etc/issue.net
# Subsystem sftp /usr/lib/openssh/sftp-server
AllowGroups sshvpn
# SSHVPN nastavenia
Match Group sshvpn
PasswordAuthentication no
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding yes
ForceCommand /bin/sshvpn
PermitOpen 192.168.1.37:993 192.168.1.37:25
-----------------------------------------
Create the command that runs after login, "/bin/sshvpn"
-------------------------------------------------------
# chroot $CHROOT /bin/bash --login
CHROOT-sshvpn:/# nano /bin/sshvpn
-------------------------------------------------------------
#!/bin/bash
echo "SSH VPN ACCESS"
echo "For terminate a connection press ENTER ..."
read
-------------------------------------------------------------
Make the command "/bin/sshvpn" executable
-----------------------------------------
CHROOT-sshvpn:/# chmod +x /bin/sshvpnCreating the "sshvpn1" account to serve as the VPN account, and generating its keys
Vytvorenie uctu "sshvpn1"
-------------------------
# adduser sshvpn1
# usermod -a -G sshvpn sshvpn1
# passwd sshvpn1 (heslo_k_uctu)
Vygenerovanie klucov pre ucet "sshvpn1"
-----------------------------------------
# su - sshvpn1
# ssh-keygen -t dsa (heslo_ku_klucu)
Distribucia verejneho kluca
---------------------------
# cd ~/.ssh
# cat id_dsa.pub >> authorized_keys
# chmod 600 authorized_keysLINKz
Getting started with SSH security and configuration
---------------------------------------------------
http://www.ibm.com/developerworks/aix/library/au-sshsecurity/
1 - Stavime tunely v OpenSSH
----------------------------
http://www.root.cz/clanky/stavime-tunely-v-openssh/
2 - DNSSEC jako bezpecne uloziste SSH klicu
-------------------------------------------
http://www.root.cz/clanky/dnssec-jako-bezpecne-uloziste-ssh-klicu/
3 - Certifikaty v OpenSSH
-------------------------
http://www.root.cz/clanky/certifikaty-v-openssh/
4 - Zavadime omezeni v OpenSSH
------------------------------
http://www.root.cz/clanky/zavadime-omezeni-v-openssh/
5 - Sdilene, interaktivni a hashovane OpenSSH
---------------------------------------------
http://www.root.cz/clanky/sdilene-interaktivni-a-hashovane-openssh/
SSH User Identities
-------------------
http://www.symantec.com/connect/articles/ssh-user-identities
SSH - OpenSSH
-------------
https://help.ubuntu.com/community/SSH
https://help.ubuntu.com/community/SSH/OpenSSH/Keys
https://help.ubuntu.com/community/SSH/OpenSSH/Advanced
Hardening SSH and Mounting Remote Filesystem in OS X Finder via SSHFS
---------------------------------------------------------------------
http://tinyapps.org/docs/ssh_osx_and_sshfs.txt
SSH Hardening (Part I,II)
-------------------------
http://secnut.blogspot.com/2010/04/ssh-hardening-part-i.html
http://secnut.blogspot.com/2010/04/ssh-hardening-part-ii.html
Hardening SSH
-------------
http://signalboxes.net/misc/hardening-ssh/
http://www.rackaid.com/resources/how-to-harden-or-secure-ssh-for-improved-security/
Install debian server in a linux chroot environment
---------------------------------------------------
http://linuxconfig.org/install-debian-server-in-a-linux-chroot-environment