Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am deploying demo Ubuntu 10.04 LTS servers in environments I do not control and would like to have an easy and secure way to administer these machines without having to have the destination firewall forward port 22 for SSH access.

I've found a few guides to do this with reverse port (e.g. howtoforge reverse ssh tunneling guide) but I'm concerned with security of the stored ssh credentials required for the tunnel to be opened automatically.

If the machine is compromised (primary concern is physical access to the machine is out of my control) how can I stop someone from using the stored credentials to poke around in the reverse ssh tunnel target machine?

Is it possible to secure this setup, or would you suggest an alternate method?

share|improve this question
add comment

3 Answers

I'd use OpenVPN, because I know what it does and I know it can do exactly what I need, and can easily be secured -- as you rightly state, by default an SSH credential will get you onto the machine itself, which is not a wonderful idea. I know newer versions of SSH provide some sort of generic VPN functionality, and no doubt there are great ways to secure that from doing things you don't want it to, but I wouldn't be taking the risk, myself. Go with what you know.

share|improve this answer
add comment

You can use autossh to maintain a reverse tunnel which will allow you to log in with SSH. The tunnel should be created with an SSH key which has restrictions in ~/.authorized_keys so that the only thing it can do is setup the tunnel (see man authorized_keys for details). The following would only allow this key to be used from 1.2.3.4, and not allow any commands to be executed with it.

from="1.2.3.4",command="/bin/false",no-agent-forwarding,no-pty,no-X11-forwarding ssh-rsa AAAA...
share|improve this answer
    
after a bit of testing I got this working reliably with "command="/bin/false",no-agent-forwarding,no-pty,no-X11-forwarding," I also changed the sshd_config to Match User jdoe ForceCommand /bin/false when connecting using ssh client, it seems you need -N to keep the connection open once /bin/false returns –  bVector Mar 27 '12 at 7:40
add comment

Make a hole in your firewall or set up a proxy on a bypass. Yes you can have reverse ssh connections - but this is just a tunnelled socket connection - you still need to run some protocol over it (yes you could run ssh on top of the ssh connection, or you could even run pppd for a vpn connection) - trying to maintain / reinstate the connection when one end goes down will be very difficult to automate. Its only going to work if you build a lot of code around it - at which point you may be undermining the security. It's really not worth the effort.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.