2012 - Debian 5 + SSH = SSH VPN Howto

category: howtoz/archive · date: 2012-01-01 · source: old.linuxor.sk/VPN/LH_2012_SSH_VPN_howto.txt

The Slovak original of this document: 2012 - Debian 5 + SSH = SSH VPN Howto (slovensky).

SSH VPN - howto

asciiart

 Author : lala -> lala (at) linuxor (dot) sk
 Date   : 2012
====================================================================================================

====================================================================================================
 Installing the SSH server in a jail (chroot)
 Note: using the easier way (with debootstrap)
====================================================================================================

        Create the directory needed for the chroot environment
        ------------------------------------------------------
        # mkdir -p /chroot/sshvpn
        # CHROOT=/chroot/sshvpn

        If we use a proxy server, set the environment
        ---------------------------------------------
        # export http_proxy=http://192.168.21.1:8080
        # export ftp_proxy=http://192.168.21.1:8080

        [1] Install the required package "debootstrap"
        [2] Start the creation of the chroot environment
        -------------------------------------------------
        [1]# apt-get install debootstrap
        [2]# debootstrap --arch i386 squeeze $CHROOT http://ftp.sk.debian.org/debian/

        [1] Switch into the chroot environment
        [2] Configure the command line prompt
        [3] Install the SSH server
        [4] Change the password of the user "root"
        ----------------------------------------------
        [1]# chroot $CHROOT /bin/bash --login
        [2]# echo 'PS1="CHROOT-sshvpn:\w# "' >> ~/.bashrc
        [3]# CHROOT-sshvpn:/# apt-get update
        [3]# CHROOT-sshvpn:/# apt-get install ssh
        [4]# CHROOT-sshvpn:/# passwd
        [4]# CHROOT-sshvpn:/# exit

        Create the start script for the SSHVPN server
        ---------------------------------------------
        # nano /etc/init.d/chroot-sshvpn
        ---------------------------------------------
        #!/bin/bash

        CHROOT=/chroot/sshvpn
        mount -t devpts devpts $CHROOT/dev/pts
        mount -t proc proc $CHROOT/proc
        chroot $CHROOT /etc/init.d/ssh start
        ---------------------------------------------

        [1] Set execute permissions on the start script
        [2] Set the SSH server in the chroot environment to start automatically at boot
        -------------------------------------------------------------------------------
        [1]# chmod +x /etc/init.d/chroot-sshvpn
        [2]# update-rc.d chroot-sshvpn defaults

        Install and configure the required package "locales"
        ----------------------------------------------------
        # chroot $CHROOT /bin/bash --login
        CHROOT-sshvpn:/# apt-get install locales
        CHROOT-sshvpn:/# dpkg-reconfigure locales

        Set up syslog-ng so that it logs the auth events from the jail
        --------------------------------------------------------------
        # nano /etc/syslog-ng/syslog-ng.conf
        -----------------------------------------------------------
        source s_src_sshvpn { unix-dgram("/chroot/sshvpn/dev/log"); internal(); file("/proc/kmsg" program_override("kernel")); };
        destination d_auth_sshvpn { file("/chroot/sshvpn/var/log/auth.log"); };
        log { source(s_src_sshvpn); filter(f_auth); destination(d_auth_sshvpn); };
        -----------------------------------------------------------

        Restart the syslog-ng server
        ----------------------------
        # /etc/init.d/syslog-ng restart

        For the correct time inside the jail, put the file "localtime" into the jail
        ----------------------------------------------------------------------------
        # cp /etc/localtime /chroot/sshvpn/etc

Configuring the SSH server in the jail (chroot)

asciiart

        Switch into the chroot environment
        ----------------------------------
        # chroot $CHROOT /bin/bash --login

        Creating the group "sshvpn", which will contain the users who connect over SSH VPN
        ----------------------------------------------------------------------------------
        # groupadd sshvpn

        List / mapping of real users to sshvpn accounts
        ------------------------------------------------------------
        Account         | Real user             | DSA key passphrase
        ------------------------------------------------------------
        sshvpn1         | user1                | key_passphrase
        sshvpn2         | user2                 | key_passphrase
        sshvpn3         | user3                | key_passphrase

        Setting up the SSH daemon for the needs of SSH VPN
        --------------------------------------------------
        # nano /chroot/sshvpn/etc/ssh/sshd_config
        -----------------------------------------
        ListenAddress 192.168.21.130:1122
        PermitRootLogin no
        X11Forwarding no
        Banner /etc/issue.net
        # Subsystem sftp /usr/lib/openssh/sftp-server
        AllowGroups sshvpn

        # SSHVPN settings
        Match Group sshvpn
                PasswordAuthentication no
                X11Forwarding no
                AllowAgentForwarding no
                AllowTcpForwarding yes
                ForceCommand /bin/sshvpn
                PermitOpen 192.168.1.37:993 192.168.1.37:25
        -----------------------------------------

        Create the command that is run after login, "/bin/sshvpn"
        ---------------------------------------------------------
        # chroot $CHROOT /bin/bash --login
        CHROOT-sshvpn:/# nano /bin/sshvpn
        -------------------------------------------------------------
        #!/bin/bash
        echo "SSH VPN ACCESS"
        echo "For terminate a connection press ENTER ..."
        read
        -------------------------------------------------------------

        Set execute permissions on the command "/bin/sshvpn"
        ----------------------------------------------------
        CHROOT-sshvpn:/# chmod +x /bin/sshvpn

Creating the account "sshvpn1", which will serve as the VPN account + creating the keys

asciiart

        Creating the account "sshvpn1"
        ------------------------------
        # adduser sshvpn1
        # usermod -a -G sshvpn sshvpn1
        # passwd sshvpn1 (account_password)

        Generating the keys for the account "sshvpn1"
        ---------------------------------------------
        # su - sshvpn1
        # ssh-keygen -t dsa (key_passphrase)

        Distributing the public key
        ---------------------------
        # cd ~/.ssh
        # cat id_dsa.pub >> authorized_keys
        # chmod 600 authorized_keys

LINKz

asciiart

        Getting started with SSH security and configuration
        ---------------------------------------------------
        http://www.ibm.com/developerworks/aix/library/au-sshsecurity/

        1 - Stavime tunely v OpenSSH
        ----------------------------
        http://www.root.cz/clanky/stavime-tunely-v-openssh/

        2 - DNSSEC jako bezpecne uloziste SSH klicu
        -------------------------------------------
        http://www.root.cz/clanky/dnssec-jako-bezpecne-uloziste-ssh-klicu/

        3 - Certifikaty v OpenSSH
        -------------------------
        http://www.root.cz/clanky/certifikaty-v-openssh/

        4 - Zavadime omezeni v OpenSSH
        ------------------------------
        http://www.root.cz/clanky/zavadime-omezeni-v-openssh/

        5 - Sdilene, interaktivni a hashovane OpenSSH
        ---------------------------------------------
        http://www.root.cz/clanky/sdilene-interaktivni-a-hashovane-openssh/

        SSH User Identities
        -------------------
        http://www.symantec.com/connect/articles/ssh-user-identities

        SSH - OpenSSH
        -------------
        https://help.ubuntu.com/community/SSH
        https://help.ubuntu.com/community/SSH/OpenSSH/Keys
        https://help.ubuntu.com/community/SSH/OpenSSH/Advanced

        Hardening SSH and Mounting Remote Filesystem in OS X Finder via SSHFS
        ---------------------------------------------------------------------
        http://tinyapps.org/docs/ssh_osx_and_sshfs.txt

        SSH Hardening (Part I,II)
        -------------------------
        http://secnut.blogspot.com/2010/04/ssh-hardening-part-i.html
        http://secnut.blogspot.com/2010/04/ssh-hardening-part-ii.html

        Hardening SSH
        -------------
        http://signalboxes.net/misc/hardening-ssh/
        http://www.rackaid.com/resources/how-to-harden-or-secure-ssh-for-improved-security/

        Install debian server in a linux chroot environment
        ---------------------------------------------------
        http://linuxconfig.org/install-debian-server-in-a-linux-chroot-environment

Current practice (checked 2026-10)

noteThe article above is kept as it was written in 2012. This section lists what has changed since and what to do instead today.

ssh-keygen -t dsa: DSA keys no longer work. OpenSSH disabled them by default in 2015 and OpenSSH 10.0 removed DSA support completely. Use ssh-keygen -t ed25519.
Where the key is generated: the article creates the key pair on the server inside the account, so the private key has to be carried to the user afterwards. Generate the key on the user's machine and put only the public key into authorized_keys on the server.
Key restrictions: the forwarding limits can also be tied to the key itself. Since OpenSSH 7.2 the restrict option in authorized_keys switches everything off (forwarding, PTY, ~/.ssh/rc) and single features are switched back on, see the example below.
AllowTcpForwarding yes: this also permits remote (-R) forwarding. The setup needs only local forwarding, so use AllowTcpForwarding local; add PermitTTY no if clients connect with ssh -N and the ForceCommand prompt is not needed.
The debootstrap chroot: the jail is a complete second Debian 6 (squeeze, i386) installation that has to be patched separately from the host and has been without security updates for years. Today the same isolation of the VPN users is done in the host's own sshd with the Match Group sshvpn block the article already uses, or with a second sshd instance started with its own configuration file (sshd -f), so that there is only one OpenSSH to keep up to date.
Start script: /etc/init.d/chroot-sshvpn with update-rc.d is SysV init. On current Debian a second sshd is a systemd unit.
Still right: PermitRootLogin no, AllowGroups, PasswordAuthentication no, ForceCommand and PermitOpen limited to the two mail ports are still the correct way to build a forwarding-only account.
It is port forwarding, not a routed VPN: the article forwards two TCP ports. A layer 3 tunnel over SSH needs ssh -w and PermitTunnel (default no) and root on both ends; for a routed VPN the usual tool today is WireGuard.

An authorized_keys line that allows only the two forwards (the key itself is shortened here):

ini

restrict,port-forwarding,permitopen="192.168.1.37:993",permitopen="192.168.1.37:25" ssh-ed25519 AAAA... user1

Sources: