Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

A friend of mine has a xandros-based Acer netbook, and has been looking to get some remote administration and help from me while she is travelling around the world.
I've set up an account on her netbook for me to ssh into, and set up a script to reverse-ssh-tunnel from her netbook to my server - this lets me get around the problems with firewalls etc at various hostels and hotels. Once she has ssh'ed into my server, I can then ssh along to her netbook.

I've got a bash script that is run as her shell when she ssh'es into my server, which just gives her a 'please wait' sort of screen, and the only option is to exit from the script, and hence get booted from the server.

The user I've created for her on my server is low rights, but there's bound to be some exploit which would mean she would have ssh access to my server.

I'm considering also using a chroot jail, so if she escapes she'd only have access to her home directory.
Is this a good idea, and are there any other security tips that I may have missed for keeping my server secure, while still allowing me to access her netbook remotely?

To clarify, I don't think she'll try to escape from the jail, or the chroot, but I'd like to know how I could prevent this just in case.

Update:
And do you have any other suggestions for how I might access the netbook or other layers I could place in between the user and my hardware?

share|improve this question
add comment

4 Answers 4

The chroot jail will help, but with an exploit that let someone into a shell, they'd still be able to see the process table and such, and run programs, conceivably further exploits. If you want to really be aggressive about isolating the external user, it's kind of using a howitzer on an ant, but you could set up a virtual private server for the entire ssh tunnel mechanism. Then the worst they can do is trash the VPS, barring the ability to break out of one, which is a pretty high bar.

share|improve this answer
    
I like the idea, but yeah, steam-roller to crack a walnut :) Then again, if I run something really small like a terminal-only puppy-linux as the server it wouldn't be as big a steam-roller. –  Andy Jul 25 '09 at 7:45
add comment

I am a fan of a good defence in depth strategy when it comes to securing a computer system, so I would recommend that you use a low privilege account in a chrooted filesystem, and even then it is no guarantee, just look at the iPhone, it does both of these things and it still doesn't help.

share|improve this answer
add comment

Have you considered setting up VNC or another remote control app on a port that is not typically filtered by a firewall by rules?

An example config of this would have VNC (or other similar app) loaded on the notebook. Then have your notebook side script running to reach out to your server on a specific port that will not be filtered by the firewall to establish your return path to the system. 443 is probably the best port to use for this but others are also suitable. Then from your system you just connect to VNC either directly or replicate a port on your server to another port number and just connect to the interface on the local port and the port redirection will handle getting you to the other system on the remote end.

Hope this helps.

share|improve this answer
    
Thanks for the suggestion. I'd not considered that because I haven't really seen many vnc clients in linux that make the reverse connect obvious in Linux. Do you know of any? –  Andy Jul 25 '09 at 7:42
    
one way you could do this is to use a TCP/IP program that is capable of establishing the port one way. Automating this with a telnet style connect from a shell script would do nicely. Most telnet implementations allow you to specify the port you are trying to connect to. –  Axxmasterr Jul 25 '09 at 13:11
add comment

Another way to skin this animal now that I am thinking about it is to tunnel x session traffic inside an SSH tunnel as an alternative to using VNC. You are already halfway there now with your current setup.

Set up the X ability on a specific port locally to that machine, then forward that port to yourself via the tunnel and then replicate it to a port on your side so you can connect to the session on the local port on your server.

Another thing I have found which is entirely handy for this sort of thing is dynamic DNS. This will allow you to set a resolvable FQDN that you can query whenever the need arises. DyDns runs as a lightweight service on the system you have it installed on and it updates the record anytime the IP address info changes.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.