1

I run a school network, and it has one ILS (library management system) server, and about 10 computer lab computers. The lab comps all run XP pro, and connect through a series of hubs -> a home-style router (dhcp server, dns server, pppoe client)(yes, its a rather small school) -> a modem -> the phone line. The complab comps need to get online, and the ILS server has an OPAC (online public access catalog), which I need to be able to access remotely. It is accessed from a computer on the local network by simply typing the server's hostname or IP into the address bar of a browser, so I think its safe to assume that it runs on port 80, the default port for all web trafic. I also need remote access to samba shares on the server, and remote ssh access via PuTTY. The way I plan to implement this is by forwarding ports 80, 22, and whatever port it is that samba runs on (need to look that up later). My question is two parted, and assumes that the external (global) IP is static:

  • Will it work?
  • Is it safe? By this I mean will hijacking port 80 sabotage web access for the other computers? To give an example, lets say lab comp. A requests / from http://google.com. Google receives this request, and sends back an HTML document on port 80. Instead of going to lab computer A, it goes to the server as that's where port 80 was forwarded to. This is obviously a problem, as lab computer A didn't receive google's home page so that he could search for stuff.
Improve this question

4 Answers 4

Reset to default
3

Will it work?

Partly.

Is it safe? By this I mean will hijacking port 80 sabotage web access for the other computers?

Forwarding HTTP and SSH on the router is easy enough, and if you keep your library system updated, it is probably pretty secure.

Opening SMB to the internet is going to be tricky, and pretty dangerous from a security standpoint. If you need remote access to a SMB I strongly suggest you consider setting up a VPN of some sort, instead of exposing SMB to the internet.

Setting up port forwarding shouldn't break anything on outgoing requests from your workstations. Routers will usually only do address translations if requests are destined for the external address of your router.

Improve this answer
3
  • Why is remote SMB access dangerous? I can actually do without it, OPAC and SSH are really what's important.
    – EternallyGreen
    Jul 1, 2009 at 6:52
  • First SMB is not a simple protocol. You must open far more then just one port, possibly exposing things you don't want to expose. Second, it doesn't have much in the way of encryption, and a man in the middle could do bad things. Third, Microsoft's implementation of SMB has a horrible track record for exploitable security issues.
    – Zoredache
    Jul 1, 2009 at 6:59
  • Ok, thanks for the heads up, I really appreciate it and would've otherwise been clueless. I have some questions, though, and if you don't mind answering them, that would be great. Too long for the comment fields, so please see my answer below:
    – EternallyGreen
    Jul 4, 2009 at 6:50
2

It will work. When google will reply you it don't reply to the port 80 but from the source port 80 to a destination port > 1024 used by computerA as source port when sending the request.
Anyway the NAT part of your router is design to make what you want to works

Improve this answer
2
0

I agree with Zoredache the VPN is the way to go, (I heard good things about OpenVPN).

However, you could consider only portforward ssh and do the work from the computer you have ssh access to (this is quick and very easy).

/Johan

Improve this answer
5
  • Sorry, can you please clarify?
    – EternallyGreen
    Jul 1, 2009 at 6:53
  • Instead of working from the computer you sit in front of, you use you local computer as a terminal and login into the computer with the ssh server. Then since that computer is on your local network you can do whatever you want from that computer.
    – Johan
    Jul 1, 2009 at 8:39
  • But if you can't use this (you mentioned Windows computers in your question) so maybe you have to use the more complicated solution with vpn.
    – Johan
    Jul 1, 2009 at 8:42
  • Ahhh, very clever. Only problem is, I can't make everyone who uses the computers learn to set up SSH every time the want to access their files.
    – EternallyGreen
    Jul 2, 2009 at 7:36
  • Then go with vpn, that way once the vpn-tunnel is up the computer behaves as if it was inside your firewall and the users could use samba directly. (And the vpn tunnel takes care of the security issue). And there you don't need any port forwarding either.
    – Johan
    Jul 2, 2009 at 7:43
-1

You say it doesn't have encryption, but that's OK. I can still set up authentication with a username/password access restriction scheme. That would prevent the files in the SMB shares from being publicly accessible. Now the only problem left resulting from lack of encryption I can think of is that once one of my users has authenticated and is downloading things remotely, someone could then intercept the unencrypted traffic and read it. This is not of concern to me. Its just children's schoolwork, and its not going to be used for transferring anything sensitive. The other way this vulnerability could be exploited is by intercepting the traffic and injecting other, fake traffic in its place. Let's say a user tries to download file A. A MITM intercepts the download traffic, steals the contents of file A, and then replaces the traffic with some other data. Now this would not be a problem for me either, because people would know that what they got wasn't the file they were expecting. They would know something's wrong, and try again or just not depend on it.

Your 3rd point is that M$'s implementation sucks. Now, based on what I think you mean by this, it shouldn't apply to me. You see, my would-be SMB server runs ubuntu linux, and only the remote clients would run windows. Is this still a concern?

What I am left with is that I'm exposing other ports that I may not want to. Can you please be more specific? What's the worst that could actually result from this?

Ok, thanks so much for your time, this will make my life a lot easier.

P.S.: I apologize if my question isn't the clearest, I've had about 8 hours of sleep in the last 3 days, so I'm really running on empty, so-to-speak. I've tried really hard to make it as clear and coherent as possible, but if you have any questions, just ask me.

Improve this answer

You must log in to answer this question.