0

I have the following setup:

I have a server using XEN to run several virtual machines. All of them are connected to various (virtual or physical) networks. I have the internet (bad guys), a DMZ network and a internal network (only good guys). I separate the networks by (virtual) routers that prevent unauthorized traffic to be stopped.

Now I want to be able to access to all machines via SSH from both inside the LAN and the internet if needed to do some remote repair. From the internet all SSH acces is redirected to a machine in the DMZ. Now I could do two differnet things from there on:

  1. Have the keys to all machines on my laptop (somewhere in the internet) and then connecting to the SSH machine. I build a tunnel to the internal router and through that I can access the internal network.
  2. Have the key to my SSH machine on the laptop and go from machine to machine through the virtual net. So the key for the router is on the SSH machine and so on.

My own suggestion was to use option 1 plus the possibility to build a tunnel from there to every PC in DMZ/LAN/VPN (iptables is active at moment).

How would you do it? What is your suggestions? Is there even a better solution?

1 Answer 1

0

Note: This is my personal opinion as someone interested in security. I am not an expert, nor have any qualification under my name.

Possible security Risk:
I believe by you having a DMZ-ed SSH server is a security risk as DMZ-ed server means firewall will simply pass any unknown / not explicitly blocked connection attempt to that server, which mean that server is prone to probing, and worst case, attack.

Recommendation #1
Have you considered having VPN server within your LAN? This way you can remove the DMZ, and still access behind your LAN via a secure tunnel with VPN.

Pro: VPN allows secure, encrypted connection from internet to your LAN. If you have VPN, you won't need DMZ - which means hopefully it will be more secure for you.

Con: VPN server can be difficult to set up, or require money to set up, and adding another layer of complexity for IT management.

And having all your eggs in 1 basket (all your secure SSH keys in your laptop) is not exactly the best way (Scenario: If you lose your laptop) - but you can always have a full disk encryption with TrueCrypt or other software so if your laptop ever leave your hand, at least your data will be fully encrypted and no bad guys can attempt to abuse those data.

If you don't have the resources / time to invest on VPN - If you have some existing NAS box (Synology, QNAP, or other brand) they may have VPN server as a module that you can download for very easy installation and set up (this is true for Synology that I owned and personally tested).

Recommendation #2
Or if VPN is truly not possible (due to whatever reason) - then perhaps consider a remote support software?
(GotoAssist, TeamViewer, Logmein to name a few).
Install the client on a machine you trust inside your LAN, and simply connect to that machine from the internet. And then using that machine as your jumping point, you can SSH everywhere, as if you are sitting in front of the machine inside your LAN.

Pro: You can keep your SSH keys in a PC INSIDE your LAN. Secured behind your corporate firewall. Con: A 3rd party software is required to allow the connection from Internet into your LAN. And the software may cost money.

Personal experience: TeamViewer is definitely very easy to use, and free for personal use. And also TeamViewer has an option to connect via VPN (Unfortunately I have not personally tested this, but I have seen the option to install VPN driver) - added benefit of securing your connection.

Hope this helps.

2
  • OK, in the DMZ there IS a VPN yet. But this tends to fail (forgotten to update the outdating certificates). Unfortunately I do not understand your point in the first part: I have different virtual machines for Apache, for SSH, for VPN and so on. Access to the port 22 gets NATed to the SSH server (as other ports get NATed to their destination). Except for SSH attempts the SSH will never be rechable. So I do not get the point, sorry. Oct 6, 2013 at 15:47
  • @ChristianWolf My understanding that if a server is set as DMZ target, any incoming connection to a port that the firewall has no known forwarding will simply forward the connection to the DMZ server, and the DMZ server will have to handle the incoming connection (based on the DMZ server firewall rules) - hence why my thought of the DMZ server may get probed / attacked. Beyond that, have you considered dual SSH? ie. SSH to the DMZ server and then SSH to all other services (similar to your #1 solution) But this does means your DMZ server need to accept SSH and prone to attack.
    – Darius
    Oct 7, 2013 at 11:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .