2012 - Debian 5 + SSH = SSH VPN Howto

category: howtoz · date: 2016-10-24 · source: old.linuxor.sk/VPN/LH_2012_SSH_VPN_howto.txt

Anglická verzia tohto dokumentu: 2012 - Debian 5 + SSH = SSH VPN Howto.

SSH VPN - howto

asciiart

 Author : lala -> hajzer (at) gmail (dot) com
 Date   : 2012
====================================================================================================

====================================================================================================
 Nainstalovanie SSH servera v klietke (chroot)
 Poznamka: pouzitie lahsej cesty (pomocou debootstrap)
====================================================================================================

        Vytvorime potrebny adresar pre chroot prostredie
        ------------------------------------------------
        # mkdir -p /chroot/sshvpn
        # CHROOT=/chroot/sshvpn

        Ak pouzivame proxy server nastavime prostredie
        ----------------------------------------------
        # export http_proxy=http://192.168.21.1:8080
        # export ftp_proxy=http://192.168.21.1:8080

        [1] Nainstalujeme potrebny balicek "debootstrap"
        [2] Spustime vytvorenie chroot prostredia
        -------------------------------------------------
        [1]# apt-get install debootstrap
        [2]# debootstrap --arch i386 squeeze $CHROOT http://ftp.sk.debian.org/debian/

        [1] Prepneme sa do chroot prostredia
        [2] Nakonfigurujeme prompt prikazoveho riadku
        [3] Nainstalujeme SSH server
        [4] Zmenime heslo pre uzivatela "root"
        ----------------------------------------------
        [1]# chroot $CHROOT /bin/bash --login
        [2]# echo 'PS1="CHROOT-sshvpn:\w# "' >> ~/.bashrc
        [3]# CHROOT-sshvpn:/# apt-get update
        [3]# CHROOT-sshvpn:/# apt-get install ssh
        [4]# CHROOT-sshvpn:/# passwd
        [4]# CHROOT-sshvpn:/# exit

        Vytvorime startovaci skript pre SSHVPN server
        ---------------------------------------------
        # nano /etc/init.d/chroot-sshvpn
        ---------------------------------------------
        #!/bin/bash

        CHROOT=/chroot/sshvpn
        mount -t devpts devpts $CHROOT/dev/pts
        mount -t proc proc $CHROOT/proc
        chroot $CHROOT /etc/init.d/ssh start
        ---------------------------------------------

        [1] Nastavime prava na spustanie pre startovaci skript
        [2] Nastavime automaticke spustanie SSH servera po starte v chroot prostredi
        ----------------------------------------------------------------------------
        [1]# chmod +x /etc/init.d/chroot-sshvpn
        [2]# update-rc.d chroot-sshvpn defaults

        Nainstalujeme a nakonfigurujeme potrebny balicek "locales"
        ----------------------------------------------------------
        # chroot $CHROOT /bin/bash --login
        CHROOT-sshvpn:/# apt-get install locales
        CHROOT-sshvpn:/# dpkg-reconfigure locales

        Nastavime syslog-ng tak aby logoval auth udalosti z klietky
        -----------------------------------------------------------
        # nano /etc/syslog-ng/syslog-ng.conf
        -----------------------------------------------------------
        source s_src_sshvpn { unix-dgram("/chroot/sshvpn/dev/log"); internal(); file("/proc/kmsg" program_override("kernel")); };
        destination d_auth_sshvpn { file("/chroot/sshvpn/var/log/auth.log"); };
        log { source(s_src_sshvpn); filter(f_auth); destination(d_auth_sshvpn); };
        -----------------------------------------------------------

        Restartujeme syslog-ng server
        -----------------------------
        # /etc/init.d/syslog-ng restart

        Kvoli spravnemu casu v klietke umiestnime subor "localtime" do klietky
        ----------------------------------------------------------------------
        # cp /etc/localtime /chroot/sshvpn/etc

Konfiguracia SSH servera v klietke (chroot)

asciiart

        Prepneme sa do chroot prostredia
        --------------------------------
        # chroot $CHROOT /bin/bash --login

        Vytvorenie skupiny "sshvpn", ktora bude obsahovat uzivatelov, ktory pristupuju cez SSH VPN
        -------------------------------------------------------------------------------------------
        # groupadd sshvpn

        Zoznam / mapovanie realnych uzivatelov na sshvpn ucty
        ------------------------------------------------------------
        Ucet            | Realny uzivatel       | DSA key passphrase
        ------------------------------------------------------------
        sshvpn1         | user1                | heslo_ku_klucu
        sshvpn2         | user2                 | heslo_ku_klucu
        sshvpn3         | user3                | heslo_ku_klucu

        Nastavenie SSH demona pre potreby SSH VPN
        -----------------------------------------
        # nano /chroot/sshvpn/etc/ssh/sshd_config
        -----------------------------------------
        ListenAddress 192.168.21.130:1122
        PermitRootLogin no
        X11Forwarding no
        Banner /etc/issue.net
        # Subsystem sftp /usr/lib/openssh/sftp-server
        AllowGroups sshvpn

        # SSHVPN nastavenia
        Match Group sshvpn
                PasswordAuthentication no
                X11Forwarding no
                AllowAgentForwarding no
                AllowTcpForwarding yes
                ForceCommand /bin/sshvpn
                PermitOpen 192.168.1.37:993 192.168.1.37:25
        -----------------------------------------

        Vytvorime prikaz, ktory sa spusti po prihlaseni "/bin/sshvpn"
        -------------------------------------------------------------
        # chroot $CHROOT /bin/bash --login
        CHROOT-sshvpn:/# nano /bin/sshvpn
        -------------------------------------------------------------
        #!/bin/bash
        echo "SSH VPN ACCESS"
        echo "For terminate a connection press ENTER ..."
        read
        -------------------------------------------------------------

        Nastavime prava na vykonavanie pre prikaz "/bin/sshvpn"
        -------------------------------------------------------
        CHROOT-sshvpn:/# chmod +x /bin/sshvpn

Vytvorenie uctu "sshvpn1", ktory bude sluzit ako VPN ucet + vytvorenie klucov

asciiart

        Vytvorenie uctu "sshvpn1"
        -------------------------
        # adduser sshvpn1
        # usermod -a -G sshvpn sshvpn1
        # passwd sshvpn1 (heslo_k_uctu)

        Vygenerovanie klucov pre ucet "sshvpn1"
        -----------------------------------------
        # su - sshvpn1
        # ssh-keygen -t dsa (heslo_ku_klucu)

        Distribucia verejneho kluca
        ---------------------------
        # cd ~/.ssh
        # cat id_dsa.pub >> authorized_keys
        # chmod 600 authorized_keys

LINKz

asciiart

        Getting started with SSH security and configuration
        ---------------------------------------------------
        http://www.ibm.com/developerworks/aix/library/au-sshsecurity/

        1 - Stavime tunely v OpenSSH
        ----------------------------
        http://www.root.cz/clanky/stavime-tunely-v-openssh/

        2 - DNSSEC jako bezpecne uloziste SSH klicu
        -------------------------------------------
        http://www.root.cz/clanky/dnssec-jako-bezpecne-uloziste-ssh-klicu/

        3 - Certifikaty v OpenSSH
        -------------------------
        http://www.root.cz/clanky/certifikaty-v-openssh/

        4 - Zavadime omezeni v OpenSSH
        ------------------------------
        http://www.root.cz/clanky/zavadime-omezeni-v-openssh/

        5 - Sdilene, interaktivni a hashovane OpenSSH
        ---------------------------------------------
        http://www.root.cz/clanky/sdilene-interaktivni-a-hashovane-openssh/

        SSH User Identities
        -------------------
        http://www.symantec.com/connect/articles/ssh-user-identities

        SSH - OpenSSH
        -------------
        https://help.ubuntu.com/community/SSH
        https://help.ubuntu.com/community/SSH/OpenSSH/Keys
        https://help.ubuntu.com/community/SSH/OpenSSH/Advanced

        Hardening SSH and Mounting Remote Filesystem in OS X Finder via SSHFS
        ---------------------------------------------------------------------
        http://tinyapps.org/docs/ssh_osx_and_sshfs.txt

        SSH Hardening (Part I,II)
        -------------------------
        http://secnut.blogspot.com/2010/04/ssh-hardening-part-i.html
        http://secnut.blogspot.com/2010/04/ssh-hardening-part-ii.html

        Hardening SSH
        -------------
        http://signalboxes.net/misc/hardening-ssh/
        http://www.rackaid.com/resources/how-to-harden-or-secure-ssh-for-improved-security/

        Install debian server in a linux chroot environment
        ---------------------------------------------------
        http://linuxconfig.org/install-debian-server-in-a-linux-chroot-environment