I've been trying, and not been able to find a way to do this. I'm looking to setup a server administrative web-based control panel (along the lines of webmin) but trying to add an extremely difficult to spoof security measure that's mostly transparent to those with access and coming up empty. I have an idea in mind that sounds suitable, but am at a loss for a really workable solution.
I have port knocking setup on top of key-only authentication on ssh. It's reduced attack attempts to nearly nil. I am rather content with the ssh security measures in place, but it has proved fruitless to bring the same security to nginx.
Is it possible to setup something akin to port knocking so that only a user actively logged into ssh has a port open on http? I can't simply use ESTABLISHED since I'm wanting to require being authenticated in ssh as well.
Ideal solution would work something like this...
- no ssh connection -> DROP attempts to access nginx port
- active ssh connection, not authenticated -> DROP attempts to access nginx port
- active ssh connection, authenticated -> ACCEPT nginx port connections
I realize a terminate session would result in the activity to switch to DROP, which would be acceptable.
Closest solution I've been able to come up with involves scanning ssh logs via cron and modifying iptables on the fly, but there needs to be a better way. Open to ideas, if nothing else, to point me in the right direction.
Can you please edit your question to give a bit of background on why you need this level of security? It seems like overkill. – Tim
I mentioned server administration ala Webmin. In a nutshell, php/py scripts with access to server internals such as iptables, /etc modification, shutdown/reboot, log parsers, other maintenance tools. Access would require sudo to the server itself, hence, wanting to keep it extremely protected.