6 ms·

Show HN: Automatic proxy setup for SSH'able boxes that have no network access

51 points by _jhqp 5y ago

egberts1 5y ago
I love the innocuous application of enabling just the Debian package management behind such draconian firewalls. Makes me wonder if there are any other applications to be had there. (I am a JavaScript pentester)
egberts1 5y ago
Only way to block this is that “airgapt” thingie is hopefully this sshd_config setting: # DisableForwarding disables all forwarding features, # including X11, ssh-agent(1), TCP and StreamLocal. # This option overrides all other forwarding-related # options and may simplify restricted configurations. # # CLI option: -o # options.disable_forwarding/do_authenticated() DisableForwarding no
1cvmask 5y ago
I couldn't find the license for it. Is it open source? If so what license?
- _jhqp 5y ago
  I added MIT license now :)
_jhqp 5y ago
All comments & suggestions / code reviews are welcome!
SahAssar 5y ago
I don't really get what the definition of "network" is here, clearly the box has network access since it is SSH'able. Could you give an example of a situation when this is used?
- mrweasel 5y ago
  The name, Airgapt - "airgapped" apt, is also a little "weird". When I work on air gapped devices it normally involved bringing DVDs and physically going to a datacenter.
  - _jhqp 5y ago
    Agreed :) That's why I put it in "quotes" Can you propose an alternative / more accurate name?
    - mrweasel 5y ago
      I'd rather not :-) Naming things is hard. I love the project though, not because I need it, but it proves one of my point: "If you didn't want me to be able to do X, then you shouldn't have allowed SSH access".
    - deleted 5y ago
      [deleted]
  - 3np 5y ago
    I think the name is quite apt (:
- _jhqp 5y ago
  "Network access" as in outgoing requests to public web. e.g. you can't curl google.com I've used this code in CTF competitions and Blue Team exercises where some machines behind a VPN don't have outgoing network access. (Sometimes it's just simpler to organize this way, sometimes it's deliberate for security purposes.)
  - SahAssar 5y ago
    So restricted HTTP access, but wide open SSH? Do people commonly restrict only HTTP/HTTPS but leave other ports unrestricted?
    - 5y ago
gjulianm 5y ago
Something to add: use proxychains to ensure that the requests of all apps go through the proxy. A lot of applications don't have good proxy support, or have nothing at all. If you configure proxychains with the SOCKS proxy provided by this script, then you can do "proxychains my-command-that-doesnt-use-proxy" and it will automatically patch the libc calls to use the proxy properly.
- _jhqp 5y ago
  Good suggestion. Added it to the README as an optional addition.
rp1 5y ago
Isn’t this typically called an ssh bastion?
- _jhqp 5y ago
  Looks like :) https://github.com/ovh/the-bastion https://github.com/ovh/the-bastion
  - _jhqp 5y ago
    Though after looking into it more, it seems to me like bastions usually aren't used for reverse proxy / SOCKS like this. Usually bastions are just allowing one SSH server on your VPC/network and every SSH connection going through it. I still actually haven't found similar projects to mine.
    - egberts1 5y ago
      Bastion SSH? This new-finagle “airgapt” makes GatewayPorts sshd_option setting of OpenSSL kinda useless? My code review notes says: # GatewayPorts specifies whether remote hosts are # allowed to connect to ports forwarded for the # client. By default, sshd(8) binds remote port # forwardings to the loopback address. This prevents # other remote hosts from connecting to forwarded # ports. GatewayPorts can be used to specify that sshd # should allow remote port forwardings to bind to # non-loopback addresses, thus allowing other hosts to # connect. The argument may be no to force remote port # forwardings to be available to the local host only, # yes to force remote port forwardings to bind to the # wildcard address, or clientspecified to allow the # client to select the address to which the forwarding # is bound. # # CLI option: -o # options.fwd_opts.gateway_ports/channel_fwd_bind_addr()/channel_setup_fwd_listener_tcpip()/channel_setup_remote_fwd_listener() # options.fwd_opts.gateway_ports/channel_fwd_bind_addr()/channel_setup_fwd_listener_tcpip()/channel_setup_local_fwd_listener() # GatewayPorts defaults to 'no'.
      - _jhqp 5y ago
        You are absolutely correct. I updated to not use GatewayPorts in v0.1.1 Thank you for the feedback! https://github.com/AkselAllas/airgapt/issues/1 https://github.com/AkselAllas/airgapt/issues/1

51 points by _jhqp 5y ago

I love the innocuous application of enabling just the Debian package management behind such draconian firewalls. Makes me wonder if there are any other applications to be had there. (I am a JavaScript pentester)

egberts1 5y ago

Only way to block this is that “airgapt” thingie is hopefully this sshd_config setting: # DisableForwarding disables all forwarding features, # including X11, ssh-agent(1), TCP and StreamLocal. # This option overrides all other forwarding-related # options and may simplify restricted configurations. # # CLI option: -o # options.disable_forwarding/do_authenticated() DisableForwarding no

1cvmask 5y ago

I couldn't find the license for it. Is it open source? If so what license?

_jhqp 5y ago
I added MIT license now :)

_jhqp 5y ago

All comments & suggestions / code reviews are welcome!

SahAssar 5y ago

I don't really get what the definition of "network" is here, clearly the box has network access since it is SSH'able. Could you give an example of a situation when this is used?

mrweasel 5y ago
The name, Airgapt - "airgapped" apt, is also a little "weird". When I work on air gapped devices it normally involved bringing DVDs and physically going to a datacenter.
- _jhqp 5y ago
  Agreed :) That's why I put it in "quotes" Can you propose an alternative / more accurate name?
  - mrweasel 5y ago
    I'd rather not :-) Naming things is hard. I love the project though, not because I need it, but it proves one of my point: "If you didn't want me to be able to do X, then you shouldn't have allowed SSH access".
  - deleted 5y ago
    [deleted]
- 3np 5y ago
  I think the name is quite apt (:
_jhqp 5y ago
"Network access" as in outgoing requests to public web. e.g. you can't curl google.com I've used this code in CTF competitions and Blue Team exercises where some machines behind a VPN don't have outgoing network access. (Sometimes it's just simpler to organize this way, sometimes it's deliberate for security purposes.)
- SahAssar 5y ago
  So restricted HTTP access, but wide open SSH? Do people commonly restrict only HTTP/HTTPS but leave other ports unrestricted?
  - 5y ago

gjulianm 5y ago

Something to add: use proxychains to ensure that the requests of all apps go through the proxy. A lot of applications don't have good proxy support, or have nothing at all. If you configure proxychains with the SOCKS proxy provided by this script, then you can do "proxychains my-command-that-doesnt-use-proxy" and it will automatically patch the libc calls to use the proxy properly.

_jhqp 5y ago
Good suggestion. Added it to the README as an optional addition.

rp1 5y ago

Isn’t this typically called an ssh bastion?

_jhqp 5y ago
Looks like :) https://github.com/ovh/the-bastion https://github.com/ovh/the-bastion
- _jhqp 5y ago
  Though after looking into it more, it seems to me like bastions usually aren't used for reverse proxy / SOCKS like this. Usually bastions are just allowing one SSH server on your VPC/network and every SSH connection going through it. I still actually haven't found similar projects to mine.
  - egberts1 5y ago
    Bastion SSH? This new-finagle “airgapt” makes GatewayPorts sshd_option setting of OpenSSL kinda useless? My code review notes says: # GatewayPorts specifies whether remote hosts are # allowed to connect to ports forwarded for the # client. By default, sshd(8) binds remote port # forwardings to the loopback address. This prevents # other remote hosts from connecting to forwarded # ports. GatewayPorts can be used to specify that sshd # should allow remote port forwardings to bind to # non-loopback addresses, thus allowing other hosts to # connect. The argument may be no to force remote port # forwardings to be available to the local host only, # yes to force remote port forwardings to bind to the # wildcard address, or clientspecified to allow the # client to select the address to which the forwarding # is bound. # # CLI option: -o # options.fwd_opts.gateway_ports/channel_fwd_bind_addr()/channel_setup_fwd_listener_tcpip()/channel_setup_remote_fwd_listener() # options.fwd_opts.gateway_ports/channel_fwd_bind_addr()/channel_setup_fwd_listener_tcpip()/channel_setup_local_fwd_listener() # GatewayPorts defaults to 'no'.
    - _jhqp 5y ago
      You are absolutely correct. I updated to not use GatewayPorts in v0.1.1 Thank you for the feedback! https://github.com/AkselAllas/airgapt/issues/1 https://github.com/AkselAllas/airgapt/issues/1