1

I've been trying, and not been able to find a way to do this. I'm looking to setup a server administrative web-based control panel (along the lines of webmin) but trying to add an extremely difficult to spoof security measure that's mostly transparent to those with access and coming up empty. I have an idea in mind that sounds suitable, but am at a loss for a really workable solution.

I have port knocking setup on top of key-only authentication on ssh. It's reduced attack attempts to nearly nil. I am rather content with the ssh security measures in place, but it has proved fruitless to bring the same security to nginx.

Is it possible to setup something akin to port knocking so that only a user actively logged into ssh has a port open on http? I can't simply use ESTABLISHED since I'm wanting to require being authenticated in ssh as well.

Ideal solution would work something like this...

  • no ssh connection -> DROP attempts to access nginx port
  • active ssh connection, not authenticated -> DROP attempts to access nginx port
  • active ssh connection, authenticated -> ACCEPT nginx port connections

I realize a terminate session would result in the activity to switch to DROP, which would be acceptable.

Closest solution I've been able to come up with involves scanning ssh logs via cron and modifying iptables on the fly, but there needs to be a better way. Open to ideas, if nothing else, to point me in the right direction.


Can you please edit your question to give a bit of background on why you need this level of security? It seems like overkill. – Tim

I mentioned server administration ala Webmin. In a nutshell, php/py scripts with access to server internals such as iptables, /etc modification, shutdown/reboot, log parsers, other maintenance tools. Access would require sudo to the server itself, hence, wanting to keep it extremely protected.

  • 1
    Can you please edit your question to give a bit of background on why you need this level of security? It seems like overkill. – Tim Aug 2 '17 at 4:10
  • If you only want to allow HTTP access to clients who are connected over SSH, then simply rely on SSH port forwarding and don't open up the nginx port(s) in your firewall at all. – HBruijn Aug 2 '17 at 8:28
  • With Lua scripting you can do some intermediate checks before Nginx is happy to proceed. Here's an example of a different type of two factor authentication that may help you find the right direction: stavros.io/posts/writing-an-nginx-authentication-module-in-lua In your case, you'd have the Lua script checks against the open SSHD connections and the status of those. – JayMcTee Aug 2 '17 at 8:58
  • Never mention control panels in your questions. – peterh Aug 4 '17 at 1:05
  • Only reason I did was to explain why I wanted the extra layer of security on a specific port. The 'control panel' I've setup locally does everything I need and works well, but I use it in house, and it's rather simple to lock down to LAN access only. Honestly, if I could find a way for the server to execute a command when an SSH session terminates (expectedly or unexpectedly) then that would probably suffice. – FWishbringer Aug 5 '17 at 20:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.