9

A friend of mine has a xandros-based Acer netbook, and has been looking to get some remote administration and help from me while she is travelling around the world.
I've set up an account on her netbook for me to ssh into, and set up a script to reverse-ssh-tunnel from her netbook to my server - this lets me get around the problems with firewalls etc at various hostels and hotels. Once she has ssh'ed into my server, I can then ssh along to her netbook.

I've got a bash script that is run as her shell when she ssh'es into my server, which just gives her a 'please wait' sort of screen, and the only option is to exit from the script, and hence get booted from the server.

The user I've created for her on my server is low rights, but there's bound to be some exploit which would mean she would have ssh access to my server.

I'm considering also using a chroot jail, so if she escapes she'd only have access to her home directory.
Is this a good idea, and are there any other security tips that I may have missed for keeping my server secure, while still allowing me to access her netbook remotely?

To clarify, I don't think she'll try to escape from the jail, or the chroot, but I'd like to know how I could prevent this just in case.

Update:
And do you have any other suggestions for how I might access the netbook or other layers I could place in between the user and my hardware?

4 Answers 4

3

Have you considered setting up VNC or another remote control app on a port that is not typically filtered by a firewall by rules?

An example config of this would have VNC (or other similar app) loaded on the notebook. Then have your notebook side script running to reach out to your server on a specific port that will not be filtered by the firewall to establish your return path to the system. 443 is probably the best port to use for this but others are also suitable. Then from your system you just connect to VNC either directly or replicate a port on your server to another port number and just connect to the interface on the local port and the port redirection will handle getting you to the other system on the remote end.

Hope this helps.

2
  • Thanks for the suggestion. I'd not considered that because I haven't really seen many vnc clients in linux that make the reverse connect obvious in Linux. Do you know of any?
    – Andy
    Jul 25, 2009 at 7:42
  • one way you could do this is to use a TCP/IP program that is capable of establishing the port one way. Automating this with a telnet style connect from a shell script would do nicely. Most telnet implementations allow you to specify the port you are trying to connect to.
    – Axxmasterr
    Jul 25, 2009 at 13:11
2

The chroot jail will help, but with an exploit that let someone into a shell, they'd still be able to see the process table and such, and run programs, conceivably further exploits. If you want to really be aggressive about isolating the external user, it's kind of using a howitzer on an ant, but you could set up a virtual private server for the entire ssh tunnel mechanism. Then the worst they can do is trash the VPS, barring the ability to break out of one, which is a pretty high bar.

1
  • I like the idea, but yeah, steam-roller to crack a walnut :) Then again, if I run something really small like a terminal-only puppy-linux as the server it wouldn't be as big a steam-roller.
    – Andy
    Jul 25, 2009 at 7:45
2

I am a fan of a good defence in depth strategy when it comes to securing a computer system, so I would recommend that you use a low privilege account in a chrooted filesystem, and even then it is no guarantee, just look at the iPhone, it does both of these things and it still doesn't help.

2

Another way to skin this animal now that I am thinking about it is to tunnel x session traffic inside an SSH tunnel as an alternative to using VNC. You are already halfway there now with your current setup.

Set up the X ability on a specific port locally to that machine, then forward that port to yourself via the tunnel and then replicate it to a port on your side so you can connect to the session on the local port on your server.

Another thing I have found which is entirely handy for this sort of thing is dynamic DNS. This will allow you to set a resolvable FQDN that you can query whenever the need arises. DyDns runs as a lightweight service on the system you have it installed on and it updates the record anytime the IP address info changes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .