| View previous topic :: View next topic |
| Author |
Message |
GetCool
Guru
Joined: 23 Nov 2003
Posts: 324
Location: Madison, Wisconsin
|
 Posted: Tue Apr 20, 2004 7:04 pm Post subject: [RESOLVED] SSH tunnel access without a working shell? |
 |
|
I have a strange request that I'm not sure is possible, but here it is:
What I want to do is give a bunch of Windows clients access to samba shares on my server over an SSH tunnel. I have found a solution on these forums that is pretty easy to do: just run Putty on the Windows client, establish an SSH connection and tunnel port 139, and you can go right to the share using Windows Explorer. The problem with this, however, is that it requires the user to log in to a shell using Putty to establish the tunnel. I don't want this.
Is there a way that I can let users tunnel port 139 without having shell access? I have looked at scponly and rssh, but I don't know if either of those will work here since they are meant for SCP/SFTP (plus I wouldn't be able to use Putty anymore). On that note, I should mention that I don't want to use SCP/SFTP because I want the Windows clients to be able to access the shares as seamlessly as possible so the files can be accessed directly from programs.
I also thought about chrooting users to their home dirs or something, but I don't know if that's the best idea or not. Any suggestions?
Thanks.
Last edited by GetCool on Thu Apr 22, 2004 6:19 pm; edited 1 time in total |
|
| Back to top |
|
 |
trossachs
Veteran
Joined: 22 Jan 2004
Posts: 1204
Location: London
|
| Posted: Tue Apr 20, 2004 7:21 pm Post subject: |
|
|
I'm glad you have posted this question as I would also like to know how this would work. I've setup SSH tunnelling with M$ and Nix boxes, but a straight thru, username/password arrangement would be pref.
Or even, using the same kind of encryption key depending on which client generated the key. |
|
| Back to top |
|
|
bone
Apprentice
Joined: 07 Jun 2002
Posts: 255
Location: Midwest, USA
|
| Posted: Wed Apr 21, 2004 1:30 am Post subject: |
|
|
I have never did anything like this before, so I might just be rambling on, but couldnt you use stunnel to accomplish this?
Now you guys have me on a small tangent, and I am going to attempt to setup something like this, just to see how its done. Great, just when i thought I could sleep at work, you guys give me a mission. |
|
| Back to top |
|
|
trossachs
Veteran
Joined: 22 Jan 2004
Posts: 1204
Location: London
|
| Posted: Wed Apr 21, 2004 3:27 am Post subject: |
|
|
Stunnel? Will have to take a look at this. Post your results here, will definately be interested. Was very pleased to have sorted out my original tunnel spec with Samba.
Always room for improvement! |
|
| Back to top |
|
|
GetCool
Guru
Joined: 23 Nov 2003
Posts: 324
Location: Madison, Wisconsin
|
| Posted: Wed Apr 21, 2004 3:59 am Post subject: |
|
|
| bone wrote: | | Now you guys have me on a small tangent, and I am going to attempt to setup something like this, just to see how its done. Great, just when i thought I could sleep at work, you guys give me a mission. |
Well... we'd sure appreciate anything you may find out!
| JulesF wrote: | | Stunnel? Will have to take a look at this. |
I don't think stunnel will work. If I am not mistaken, stunnel is only good for SSL wrapping for stuff like POP and IMAP. Besides, I remember working with stunnel a number of years ago and it was kind of a pain to set up on the Windows machines. It could be different now for all I know, but skimming through the FAQ on the stunnel web site doesn't look like it has what we want. |
|
| Back to top |
|
|
trossachs
Veteran
Joined: 22 Jan 2004
Posts: 1204
Location: London
|
| Posted: Wed Apr 21, 2004 4:09 am Post subject: |
|
|
| Am I to assume that we have all setup Samba > Win2k via SSH and now we are looking for a non-terminal session environment? |
|
| Back to top |
|
|
Chris W
l33t
Joined: 25 Jun 2002
Posts: 972
Location: Brisbane, Australia
|
| Posted: Wed Apr 21, 2004 4:22 am Post subject: |
|
|
Perhaps the plink.exe tool in the PuTTY suite could do the trick. Something like: | Code: | | plink -L 139:server:139 -batch -load session_name |
could be put into a batch file and hidden behind an icon on the desktop. See PuTTY docs.
An alternate approach would be a VPN using something like OpenVPN and firewall rules to limit access to particular services.
_________________
Cheers,
Chris W
"Common sense: The collection of prejudices acquired by age 18." -- Einstein |
|
| Back to top |
|
|
GetCool
Guru
Joined: 23 Nov 2003
Posts: 324
Location: Madison, Wisconsin
|
| Posted: Wed Apr 21, 2004 5:52 am Post subject: |
|
|
| Chris W wrote: | Perhaps the plink.exe tool in the PuTTY suite could do the trick. Something like: | Code: | | plink -L 139:server:139 -batch -load session_name |
could be put into a batch file and hidden behind an icon on the desktop. See PuTTY docs. |
Thanks for the tip - I never knew the plink tool existed before - but unfortunately it's not going to help me. You can indeed use it to tunnel port 139 without any user input; I was able to get it to work even with a private DSA key with a password using this:
| Code: |
plink host_address -l user -pw pass -i private_key_file -L 139:127.0.0.1:139 -batch
|
and I could then punch \\127.0.0.1 into Explorer to go to the share.
Unfortunately for my scenario, since plink.exe.is essentially a command-line version of putty.exe, you can always use it to get to a shell as per loading a session in putty like normal. This is what I am trying to avoid. Perhaps on a strictly controlled Windows client you could use plink to achieve what I want - you could run a batch file as a hidden process with no desktop interaction, set user permissions on the batch file so users could not modify it, prevent users from opening the command prompt so they couldn't run plink with different options, etc. etc. However, I don't want to take these measures.
I was hoping there'd be something on the server side I could use, similar to scponly/rssh for SCP/SFTP where users can't get a shell no matter what.
| Quote: | | An alternate approach would be a VPN using something like OpenVPN and firewall rules to limit access to particular services. |
I have considered this, but this is an option I really would rather not pursue for this particular scenario. My real "plan B" option at this point is to give users shell access but chroot them to their home dirs or somewhere. I could then use plink to tunnel NetBIOS behind the scenes, and if a user got adventurous and actually got to his shell, he wouldn't be able to go anywhere. I hreally have no idea if chrooting SSH is secure enough, though. It could just be a bad idea. |
|
| Back to top |
|
|
fleed
l33t
Joined: 28 Aug 2002
Posts: 756
Location: London
|
| Posted: Wed Apr 21, 2004 9:14 am Post subject: |
|
|
Maybe add something to /etc/ssh/sshrc? or
command="command" in $HOME/.ssh/authorized_keys?
These are the options I thought could help you after a quick glance through `man sshd`. Maybe you could also use true for the users' shell config in /etc/passwd but you need to experiment with it to see if that doesn't stop them from logging in. |
|
| Back to top |
|
|
Lori
Guru
Joined: 30 Mar 2004
Posts: 338
Location: Barcelona, Spain
|
| Posted: Wed Apr 21, 2004 11:33 am Post subject: |
|
|
I don't know why you don't like the VPN scenario... if the clients are NT based machines, you don't even need to install any extra software, but use the built-in IPsec implementation with a shared key. Install racoon or isakmpd on the server and configure it to require encryption with the IP class you want to secure. I had a working configuration with Windows XP workstations and a FreeBSD server running racoon. And this way all communications are secured. Looks like a pretty good option to me...
_________________
"The hunt is sweeter then the kill."
Registered Linux User #176911 |
|
| Back to top |
|
|
trossachs
Veteran
Joined: 22 Jan 2004
Posts: 1204
Location: London
|
| Posted: Wed Apr 21, 2004 3:46 pm Post subject: |
|
|
| Did you use OpenVPN? Because I found that it was a real pain in the butt to configure hence the reason why I went for the SSH/Putty solution. |
|
| Back to top |
|
|
GetCool
Guru
Joined: 23 Nov 2003
Posts: 324
Location: Madison, Wisconsin
|
| Posted: Wed Apr 21, 2004 3:51 pm Post subject: |
|
|
| fleed wrote: | Maybe add something to /etc/ssh/sshrc? or
command="command" in $HOME/.ssh/authorized_keys?
These are the options I thought could help you after a quick glance through `man sshd`. Maybe you could also use true for the users' shell config in /etc/passwd but you need to experiment with it to see if that doesn't stop them from logging in. |
That 'command=' line in ~/.ssh/authorized_keys may be a solution! I don't know how exactly I could use it, though, since it would need to keep the connection open indefinitely. I'll have to look into it.
I did try setting a user's shell to /bin/true, but all that does is make putty close out immediately.
| Lori wrote: | | I don't know why you don't like the VPN scenario... if the clients are NT based machines, you don't even need to install any extra software, but use the built-in IPsec implementation with a shared key. Install racoon or isakmpd on the server and configure it to require encryption with the IP class you want to secure. I had a working configuration with Windows XP workstations and a FreeBSD server running racoon. And this way all communications are secured. Looks like a pretty good option to me... |
I guess I always assumed a VPN would be a more complex way of setting things up that I would have rather not had to do. You raise a valid point, though. However, I don't know about racoon, but I skimmed a couple docs on using the winnt IPSec tools with FreeS/WAN, and it seemed far from easy to set up. |
|
| Back to top |
|
|
GetCool
Guru
Joined: 23 Nov 2003
Posts: 324
Location: Madison, Wisconsin
|
| Posted: Thu Apr 22, 2004 6:29 pm Post subject: |
|
|
I figured out how to do it! The solution was something I thought of originally but never actually tried: to use scponly.
All I had to do was emerge scponly, add the scponly shell to /etc/shells:
and change the user's shell to the above in /etc/passwd.
On the windows end, when you log in using putty, it keeps the session open but gives you no command prompt. While it is open, the tunnel is open and you can browse the samba shares.
I also tried using plink and it worked, so it seems that this is a working solution. I am going to post another thread on this relatively soon, because I still have some questions about a few things... |
|
| Back to top |
|
|
|
Networking & Security
