imple OpenSSH Port Forwarding Tip

Recently I deployed a FreeBSD sensor on a client network. The only way I can access the sensor remotely is to use a Citrix client to connect to a Windows server. Then I use Putty to connect from the Windows server to my sensor. Argh. That is no fun.

Today I realized I should use port forwarding on OpenSSH. Here is what I do.

Connect using Citrix to the Windows server, and then use Putty to connect to the FreeBSD sensor.

On the FreeBSD sensor, use OpenSSH to connect to a system I control running an OpenSSH server. Call this box janney.taosecurity.com.

sensor$ ssh -R 2222:localhost:22 user@janney.taosecurity.com


On janney, connect to port 2222 on localhost. I am now on the remote sensor.

janney$ ssh -p 2222 user@localhost

That's it. Now I can enjoy an OpenSSH session, instead of an OpenSSH session inside a Citrix window.

Chapter 18 of Debian GNU/Linux 3.1 Bible clued me in to a more interesting scenario. Imagine three hosts, Alpha, Bravo, and Charlie. Alpha can talk to Bravo but not Charlie, and Charlie can talk to Bravo but not Alpha. Is there a way for Alpha and Charlie to talk directly to each other, through Bravo? With OpenSSH port forwarding, the answer is yes.

On host Alpha, run this command. It takes any input to port 2223 on Alpha and sends it to port 2222 on Bravo.

Alpha$ ssh -L 2223:localhost:2222 Bravo

On host Charlie, run this command. It takes any input from port 2222 on Bravo and sends it to port 22 on Charlie.

Charlie$ ssh -R 2222:localhost:22 Bravo

Finally, again on host Alpha (in a new terminal), to access Charlie from Alpha, run this command. By connecting to port 2223 on Alpha, the traffic is sent to port 2222 on Bravo, and from there to 22 on Charlie.

ssh -p 2223 localhost

This sort of access could be helpful when evading network access controls.

Comments

Anonymous said…
It's getting even better:

http://www.securityfocus.com/columnists/375
7:37 PM
Anonymous said…
It's also been an excellent way to get data too and from a host behind a NAT box.
1:13 PM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technical or pol
Read more