SSH SOCKS Proxy

SSH can even bind a SOCKS proxy, which dynamically forwards connections without hard coding a bunch of local ports.

$ ssh -Nf -D 9999 ssh-server
$ curl --socks5 localhost:9999 http://192.168.15.68/

Similarly, you could configure your browser to use a SOCKS proxy on localhost:9999

Authorized_keys restrictions

You can add restrictions to the entries in your ~/.ssh/authorized_keys file.

$ cat ~/.ssh/authorized_keys
ssh-rsa AAAANzaC1kc3MAAACBANJGoaoq+1gWhx781810vvf...EQQx7= key1@example.com
no-port-forwarding ssh-rsa AAAAIpSVdm3aqGSMOgQ7P1...Pm1X8= key2@example.com
no-agent-forwarding,no-X11-forwarding ssh-rsa AAA...xGGor= key3@example.com

Authorized_keys restrictions (continued)

Complete options are in the sshd man page. Some of the most common options:

• no-X11-forwarding, no-agent-forwarding, no-port-forwarding
• permitopen="host:port"
• from="..."
• Allows you to restrict which machines are allowed to use this pubkey
• command="..."
• Denies direct shell access and instead runs the command you specify

Command Restrictions

This command= restriction sounds great! Prevent your keys from being used for any willy-nilly command.

Unfortunately:

• You only can specify one command, not multiple options like from
• Putting security rules in authorized_keys is painful to the eyes

Enter authprogs.

Authprogs

Authprogs is an SSH command authenticator.

• Decides if the specified command should run or be rejected
• Has some minimal protocol support, e.g. scp today
• Configuration is in ~/.ssh/authprogs.yaml and files in ~/.ssh/authprogs.d directory.
• Can install keys into authorized_keys automagically
• Running at ExtraHop since 2012
• Learns from mistakes of original perl version from 2003
• Released as Open Source (GPL Licensed) at SeaGL in 2013

Installation

$ sudo pip install authprogs

Working on getting it packaged into Debian.

Installing keys

$ authprogs --install_key /path/to/id_rsa.pub
$ tail -1 ~/.ssh/authorized_keys
command="authprogs --run",no-port-forwarding ssh-rsa AAAAOg...Pm1X8= user@example.com

$ authprogs --keyname push --install_key /path/to/push.pub
$ tail -1 ~/.ssh/authorized_keys
command="authprogs --keyname push --run",no-port-forwarding ssh-rsa AAAAGxNo22Hx...

Installation automatically disables port forwarding. Tweak manually if desired.

Configuration Examples

Simplest version - a bunch of allowed commands.

$ cat ~/.ssh/authprogs.yaml
allow:
    - command: /bin/tar czvf /backups/www.tgz /var/www/
    - command: /usr/bin/touch /var/www/.backups.complete

Configuration Examples (continued)

Keyname restrictions, scp support

$ cat ~/.ssh/authprogs.d/backups.yaml
keyname: backups
allow:
    - command: /bin/tar czvf /backups/www.tgz /var/www/
    - command: /usr/bin/touch /var/www/.backups.complete
--
keyname: backup_snagger
allow:
    - rule_type: scp
      allow_download: true
      allow_recursion: true
      files:
        - /backups/www.tgz
        - /etc/

Configuration Examples (continued)

Trailing args, IP restrictions, PCRE command matching.

$ cat ~/.ssh/authprogs.d/admins.yaml
from:
    - 192.168.1.1
    - 192.168.1.2
allow:
    # Allow unrestricted ls
    - command: /bin/ls
      allow_trailing_args: true
--
from: [192.168.0.10, 192.168.0.15, 172.16.3.3]
allow:
    - command: ^sudo\s+/etc/init.d/apache2\s+(reload|restart)$
      pcre_match: true

Limitations

• Nothing that requires bash-like processing
• No multiple-command support
• No shell constructs like for or while
• No glob expansion
• Not whitespace aware

Future

Things that may get implemented:

• Rsync support
• Environment variables
• Specify authorized_keys restrictions at pubkey install time
• CIDR support
• Shell regex command matching

It's Open Source... what do you want to add? ;-)

Verifying Host Keys

Ever seen this?

$ ssh somemachine
The authenticity of host 'somemachine' can't be established.
RSA key fingerprint is b8:5a:1e:47:87:48:58:14:6b:d2:52:3c:50:55:f6:f7
Are you sure you want to continue connecting (yes/no)? 

Verifing the Host Key after login

So you have no idea if that's really the server key, you're taking it on faith. It's too late to survive a MITM. But it's not to late to see if you were subject to one!

$ ssh somemachine
The authenticity of host 'somemachine' can't be established.
RSA key fingerprint is b8:5a:1e:47:87:48:58:14:6b:d2:52:3c:50:55:f6:f7
Are you sure you want to continue connecting (yes/no)? yes
xlr@somemachine's password: (enters password)

somemachine$ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub
2048 b8:5a:1e:47:77:a8:f5:14:bc:d2:25:99:50:55:f6:f7 somehost (RSA)

If it's different, call the admininistrator!
(And change your passwords....)

Verifying Host Keys Visually

What follows is the exact same commands as before, but adding VisualHostKey for pretty pictures.

$ ssh -o VisualHostKey=yes somemachine
The authenticity of host 'somemachine' can't be established.
RSA key fingerprint is b8:5a:1e:47:87:48:58:14:6b:d2:52:3c:50:55:f6:f7
+--[ RSA 2048]----+
|    .=*o..o      |
|     +o+ . .     |
|    o =.o   . .  |
|      + .        |
|     o .         |
|    .            |
+-----------------+
Are you sure you want to continue connecting (yes/no)? yes
xlr@somemachine's password: (enters password)

Verifying Host Keys Visually (continued)

Check server's fingerprint.

somemachine$ ssh-keygen -v -l -f /etc/ssh/ssh_host_rsa_key.pub
2048 b8:5a:1e:47:77:a8:f5:14:bc:d2:25:99:50:55:f6:f7 somehost (RSA)
+--[ RSA 2048]----+
|         .   .   |
|        S   . .  |
|         = o o   |
|        o * = . .|
|         + * +E +|
|          . ++=B+|
+-----------------+

Verifying host keys visually (continued)

• Here are the fingerprints that were presented on previous slides.

  b8:5a:1e:47:87:48:58:14:6b:d2:52:3c:50:55:f6:f7
  b8:5a:1e:47:77:a8:f5:14:bc:d2:25:99:50:55:f6:f7
  

• There are tools that can generate keys with similar-looking fingerprints.
• Takeaway: Visual mode is helpful!

Showing art on all connections...

$ head -3 ~/.ssh/config
# Global configuration options
VisualHostKey yes
NumberOfPasswordPrompts 1

$ ssh somemachine
Host key fingerprint is b8:5a:1e:47:87:48:58:14:6b:d2:52:3c:50:55:f6:f7
+--[ RSA 2048]----+
|    .=*o..o      |
|     +o+ . .     |
|    o =.o   . .  |
|      + .        |
|     o .         |
|    .            |
+-----------------+
xlr@somemachine's password:

Uh oh, this is bad...

Seen this before?

$ ssh -o VisualHostKey=yes somemachine
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
b8:5a:1e:47:77:a8:f5:14:bc:d2:25:99:50:55:f6:f7
Please contact your system administrator.
Add correct host key in /home/xlr/.ssh/known_hosts to get rid of this message.
Offending RSA key in /home/xlr/.ssh/known_hosts:14
  remove with: ssh-keygen -f "/home/xlr/.ssh/known_hosts" -R somemachine
RSA host key for localhost has changed and you have requested strict checking.
Host key verification failed.

Uh oh, this is bad. (continued)

Various things can cause this warning:

• Non-security problems
• You're hitting the wrong server, e.g. a DNS/DHCP change.
• The machine has been reinstalled
• The machine had new keys generated intentionally
• Security issues
• The machine has been compromised
• Someone is doing a MITM against you
• Someone mucked with your ~/.ssh/known_hosts
• Actions
• Talk to the server administrator
• Pretend everything's OK and delete the old known_hosts key
• Run away, RUN AWAY!

Verifying Host Keys with SSHFP

Thus far our host key verification choices are

• Get the host key fingerprint out-of-band ahead of time
• Verify it matches after it's too late
• Blind faith

Verifying Host Keys with SSHFP (continued)

One Solution: Store host keys in DNS.

• New RR type, SSHFP, stores fingerprints.
• Generate the DNS data with ssh-keygen, and stick into DNS.
  

  $ ssh-keygen -r host.example.com \
               -f /etc/ssh/ssh_host_rsa_key.pub 
  somemachine IN SSHFP 1 1 8a181c1f137559eefc7b0c35fceb357af3651683
  

• Use VerifyHostKeyDNS to query DNS for keys
• yes: automatically trust DNS (if secure)
• ask: show DNS results and still ask to trust
• no: Don't look up SSHFP records at all

Verifying Host Keys with SSHFP (continued)

If you're in ask mode, or don't have DNSSEC enabled, you'll still need to answer the question, but you'll get an indication that the key is likely valid.

$ ssh -o VisualHostKey=yes somemachine
The authenticity of host 'somemachine' can't be established.
RSA key fingerprint is b8:5a:1e:47:87:48:58:14:6b:d2:52:3c:50:55:f6:f7
Matching host key fingerprint found in DNS.
Are you sure you want to continue connecting (yes/no)? 

Other options

• Push out authoritative /etc/ssh/ssh_known_hosts files to ssh client machines.
  • Perhaps build it via ssh-keyscan
  • Push via your configuration management tool of choice, or scp, etc.
  • Maybe restrict the push using authprogs ;-)

Questions?

Q&A

Thanks!

Git repository: http://github.com/daethnir/authprogs
Python PyPI package https://pypi.python.org/pypi/authprogs/
Presentation: http://www.ifokr.org/bri/presentations/lfnw-2014-ssh/

Personal	Work
Bri Hatch Onsight, Inc bri@ifokr.org	Bri Hatch ExtraHop Networks bri@extrahop.com

Copyright 2013-2014, Bri Hatch, Creative Commons BY-NC-SA License