0

My home network is currently sitting behind a DD-WRT router that I can access using public key authentication. Whenever I need to access something from my home network I can simply create an SSH tunnel from the DD-WRT router.

Providing my private key is kept safe and not compromised, I assume this is a pretty secure setup.

However, I would also like to be able to access the router even when I don't have an ssh client available and I only have a web browser available.

Can a secure solution be built (or are there existing services available) where I can use a web application (accessible via HTTPS) to access my router ?

I imagine the web application needs to be capable of creating an SSH connection to my DD-WRT router. For that, the web application needs to access my private key so it has to be sent to the web application.

I can imagine a couple of scenarios where

  • My private key is sent to the web application over https using a web form so that the web application can create the SSH connection. The web application receives the SSH key, doesn't persist the key to disk but keeps it in memory just to create the SSH connection.

  • A new keypair is generated specifically for the the web application. The web application stores the private key in its database and sends me the public key. The web application uses it to create the secure connection to my router. The web application would need to ensure that the private key is kept safe.

None of these scenarios make me feel very comfortable, but I don't know enough about security to make a proper assessment, and I would like to know if there are more appropriate solutions to this problem. (Having a web application act as an intermediary for doing this kind of SSH communication on behalf of the user ?)

Or is this something that is simply "not done".

Improve this question

2 Answers 2

Reset to default
1

You basically might chose one of the two approaches:

  1. set up what is commonly referred to as an SSL VPN - a web gateway to the services you most desperately need which would encrypt via TLS and make the services accessible via HTTP

  2. use an SSH client which is "available" even when you are sitting in front of a foreign computer - e.g. a Java applet like MindTerm.

The authentication problem you always would be having when logging in from untrusted computers could be resolved by either running 2-factor auth or one-time-passwords (or both) - take a look at OPIE to see how this could be done.

Improve this answer
2
  • A java applet is very sandboxed and runs on the browser/client, server-side components cannot take advantage of the SSH connection / SSH tunnels created with the applet. (this is good from a security point-of-view, bad from a user-experience point-of-view). Most of the actions that need to be performed on the home network infrastructure needs to be done on the server-side and cannot be done through the applet. Is allowing a server to store / use your private key considered unsafe and "not done" ?
    – ddewaele
    Feb 23, 2013 at 13:30
  • @ddewaele no, it is considered an additional potential attack vector. If you can deal with that (e.g. if you trust the server's security, if you additionally encrypt the key,...), it is "done". Other than that, you can tunnel with MindTerm.
    – the-wabbit
    Feb 23, 2013 at 13:36
0

There are a few companies around which over WebSSH such as SerFish, GotoSSH and SSHD.org. Some will let you use a private key, and some will only work with a username and password. However none of these are suitable if you don't want to hand over a private key.

The alternative option to set up a webserver on a system and use a WebSSH client you can install on your system, such as Ajaxterm or Webshell these give you the added benefit of not having to provide your private key to anyone and allow you to be in full control of security, however have a disadvantage of requiring you to set up extra security on your webserver.

Improve this answer
2
  • The issue is not handing over a private key. If it is secure I don't mind handing over the private key. The solution with the WebSSH client means that custom software needs to be installed. Ajaxterm and Webshell require setting up a webserver, something I don't want to expose on the dd-wrt router.
    – ddewaele
    Feb 23, 2013 at 13:21
  • Then use a paid service which is reputable, such as sshd.org. They've been around for 6 years.
    – sjdaws
    Feb 23, 2013 at 13:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .