From e49ccedefff31e86c49d721b30c0f40e7bc4af85 Mon Sep 17 00:00:00 2001 From: Nico Schottelius Date: Sat, 4 May 2013 01:31:44 +0200 Subject: [PATCH 1/4] callback ideas Signed-off-by: Nico Schottelius --- callback.py | 26 ++++++++++++++++++++++++++ docs/dev/logs/2013-05-04.ssh | 5 +++++ 2 files changed, 31 insertions(+) create mode 100644 callback.py create mode 100644 docs/dev/logs/2013-05-04.ssh diff --git a/callback.py b/callback.py new file mode 100644 index 00000000..b9103837 --- /dev/null +++ b/callback.py @@ -0,0 +1,26 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- +# +# 2013 Nico Schottelius (nico-cdist at schottelius.org) +# +# This file is part of cdist. +# +# cdist is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# cdist is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with cdist. If not, see . +# +# + +import os + +# SSH_CLIENT and SSH_CONNECTION available +src_ip = os.environ['SSH_CLIENT'].split()[0] diff --git a/docs/dev/logs/2013-05-04.ssh b/docs/dev/logs/2013-05-04.ssh new file mode 100644 index 00000000..b00aa44b --- /dev/null +++ b/docs/dev/logs/2013-05-04.ssh @@ -0,0 +1,5 @@ +- analysis of ssh connections for callback + SSH_CLIENT='::1 38502 22' + SSH_CONNECTION='::1 38502 ::1 22' + + -> callback possible to source host From 4ff34a7aa86ab707ee5c5643ed890547f1c436ba Mon Sep 17 00:00:00 2001 From: Nico Schottelius Date: Wed, 8 May 2013 14:09:56 +0200 Subject: [PATCH 2/4] +ideas +callback.py Signed-off-by: Nico Schottelius --- callback.py | 2 ++ docs/dev/logs/2013-05-04.ssh | 56 ++++++++++++++++++++++++++++++++++++ 2 files changed, 58 insertions(+) diff --git a/callback.py b/callback.py index b9103837..1bf5545a 100644 --- a/callback.py +++ b/callback.py @@ -24,3 +24,5 @@ import os # SSH_CLIENT and SSH_CONNECTION available src_ip = os.environ['SSH_CLIENT'].split()[0] + +print("Plain version: Connecting back to %s" % src_ip) diff --git a/docs/dev/logs/2013-05-04.ssh b/docs/dev/logs/2013-05-04.ssh index b00aa44b..9985ff05 100644 --- a/docs/dev/logs/2013-05-04.ssh +++ b/docs/dev/logs/2013-05-04.ssh @@ -3,3 +3,59 @@ SSH_CONNECTION='::1 38502 ::1 22' -> callback possible to source host + + + +[ target host ] <--------------| + | | + | | + | | + | trigger | configuration + | | + v | +[ configuration host ] ----| + + +- dynamic port allocation for tunneling + + [1:37] bento:~% ssh -R 0:localhost:22 localhost + Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts. + Allocated port 53161 for remote forward to localhost:22 + + SSH_AUTH_SOCK=/tmp/ssh-zDCWbUVcUK/agent.30749 + SSH_CLIENT='::1 38587 22' + SSH_CONNECTION='::1 38587 ::1 22' + SSH_TTY=/dev/pts/21 + + +- ssh_config: + DynamicForward + LocalForward + RemoteForward + +- testing + +[1:52] bento:cdist% netstat -anp | grep 56844 +(Not all processes could be identified, non-owned process info + will not be shown, you would have to be root to see it all.) +tcp 0 0 127.0.0.1:56844 0.0.0.0:* LISTEN - +tcp6 0 0 ::1:56844 :::* LISTEN - +[1:53] bento:cdist% + + +[1:48] bento:~% ssh -R 0:localhost:22 localhost +Allocated port 56844 for remote forward to localhost:22 +... + +- chatting + +01:42 -!- Irssi: Join to #openssh was synced in 0 secs +01:42 < telmich> good evening +01:43 < telmich> I am trying to make use of remote port forwarding using dynamic port + allocation (port=0) -- I am wondering if there is an easy way to + access the port number on the remote side easily? +01:44 < telmich> background for this question is: I'd like to allow various clients to + login to a configuration server, which then configures the clients by + using the tunnel the client provides for the server to ssh back into +02:07 < BasketCase> telmich: afaik you need to use a tool like ss/netstat/lsof to see what port it has open + From a09ee9a8145280b381f3c9fdca798a3bf76cff6a Mon Sep 17 00:00:00 2001 From: Nico Schottelius Date: Fri, 10 May 2013 13:02:45 +0200 Subject: [PATCH 3/4] +debug info Signed-off-by: Nico Schottelius --- docs/dev/logs/2013-05-04.ssh | 279 +++++++++++++++++++++++++++++++++++ 1 file changed, 279 insertions(+) diff --git a/docs/dev/logs/2013-05-04.ssh b/docs/dev/logs/2013-05-04.ssh index 9985ff05..176e5b62 100644 --- a/docs/dev/logs/2013-05-04.ssh +++ b/docs/dev/logs/2013-05-04.ssh @@ -59,3 +59,282 @@ Allocated port 56844 for remote forward to localhost:22 using the tunnel the client provides for the server to ssh back into 02:07 < BasketCase> telmich: afaik you need to use a tool like ss/netstat/lsof to see what port it has open +- ssh debug + +[11:37] bento:~% ssh -R 0:localhost:22 localhost +Allocated port 33562 for remote forward to localhost:22 + + .. . .x+=:. s + dF @88> z` ^% :8 + '88bu. %8P . server aes128-ctr hmac-md5-etm@openssh.com zlib@openssh.com [preauth] +debug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com zlib@openssh.com [preauth] +debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth] +debug1: SSH2_MSG_NEWKEYS sent [preauth] +debug1: expecting SSH2_MSG_NEWKEYS [preauth] +debug1: SSH2_MSG_NEWKEYS received [preauth] +debug1: KEX done [preauth] +debug1: userauth-request for user root service ssh-connection method none [preauth] +debug1: attempt 0 failures 0 [preauth] +debug1: PAM: initializing for "root" +debug1: PAM: setting PAM_RHOST to "localhost.localdomain" +debug1: PAM: setting PAM_TTY to "ssh" +debug1: userauth-request for user root service ssh-connection method publickey [preauth] +debug1: attempt 1 failures 0 [preauth] +debug1: test whether pkalg/pkblob are acceptable [preauth] +debug1: temporarily_use_uid: 0/0 (e=0/0) +debug1: trying public key file /root/.ssh/authorized_keys +debug1: fd 4 clearing O_NONBLOCK +debug1: matching key found: file /root/.ssh/authorized_keys, line 2 +Found matching RSA key: 2e:1b:3f:10:01:1d:21:6c:6c:1e:3d:a9:33:ba:3c:f7 +debug1: restore_uid: 0/0 +Postponed publickey for root from ::1 port 57848 ssh2 [preauth] +debug1: userauth-request for user root service ssh-connection method publickey [preauth] +debug1: attempt 2 failures 0 [preauth] +debug1: temporarily_use_uid: 0/0 (e=0/0) +debug1: trying public key file /root/.ssh/authorized_keys +debug1: fd 4 clearing O_NONBLOCK +debug1: matching key found: file /root/.ssh/authorized_keys, line 2 +Found matching RSA key: 2e:1b:3f:10:01:1d:21:6c:6c:1e:3d:a9:33:ba:3c:f7 +debug1: restore_uid: 0/0 +debug1: ssh_rsa_verify: signature correct +debug1: do_pam_account: called +Accepted publickey for root from ::1 port 57848 ssh2 +debug1: monitor_child_preauth: root has been authenticated by privileged process +debug1: Enabling compression at level 6. [preauth] +debug1: monitor_read_log: child log fd closed +debug1: PAM: establishing credentials +debug1: Entering interactive session for SSH2. +debug1: server_init_dispatch_20 +debug1: server_input_global_request: rtype tcpip-forward want_reply 1 +debug1: server_input_global_request: tcpip-forward listen localhost port 0 +debug1: Local forwarding listening on ::1 port 0. +debug1: Allocated listen port 33562 +debug1: channel 0: new [port listener] +debug1: Local forwarding listening on 127.0.0.1 port 33562. +debug1: channel 1: new [port listener] +debug1: server_input_channel_open: ctype session rchan 0 win 1048576 max 16384 +debug1: input_session_request +debug1: channel 2: new [server-session] +debug1: session_new: session 0 +debug1: session_open: channel 2 +debug1: session_open: session 0: link with channel 2 +debug1: server_input_channel_open: confirm session +debug1: server_input_global_request: rtype no-more-sessions@openssh.com want_reply 0 +debug1: server_input_channel_req: channel 2 request auth-agent-req@openssh.com reply 0 +debug1: session_by_channel: session 0 channel 2 +debug1: session_input_channel_req: session 0 req auth-agent-req@openssh.com +debug1: temporarily_use_uid: 0/0 (e=0/0) +debug1: restore_uid: 0/0 +debug1: channel 3: new [auth socket] +debug1: server_input_channel_req: channel 2 request pty-req reply 1 +debug1: session_by_channel: session 0 channel 2 +debug1: session_input_channel_req: session 0 req pty-req +debug1: Allocating pty. +debug1: session_pty_req: session 0 alloc /dev/pts/32 +debug1: server_input_channel_req: channel 2 request shell reply 1 +debug1: session_by_channel: session 0 channel 2 +debug1: session_input_channel_req: session 0 req shell +debug1: Setting controlling tty using TIOCSCTTY. + +-------------------------------------------------------------------------------- +debug1: server_input_global_request: rtype tcpip-forward want_reply 1 +debug1: server_input_global_request: tcpip-forward listen localhost port 0 +debug1: Local forwarding listening on ::1 port 0. +debug1: Allocated listen port 33562 +debug1: channel 0: new [port listener] +debug1: Local forwarding listening on 127.0.0.1 port 33562. + +[11:49] bento:openssh-6.2p1% grep "Allocated listen port" -r . +./channels.c: debug("Allocated listen port %d", +[11:49] bento:openssh-6.2p1% + + +-------------------------------------------------------------------------------- +[11:54] bento:~% ssh -R 0:localhost:22 -R 0:192.168.1.1:33 localhost +Allocated port 48392 for remote forward to localhost:22 +Allocated port 37515 for remote forward to 192.168.1.1:33 + + + + +debug1: server_input_global_request: rtype tcpip-forward want_reply 1 +debug1: server_input_global_request: tcpip-forward listen localhost port 0 +debug1: Local forwarding listening on ::1 port 0. +debug1: Allocated listen port 48392 +debug1: channel 0: new [port listener] +debug1: Local forwarding listening on 127.0.0.1 port 48392. +debug1: channel 1: new [port listener] +debug1: server_input_global_request: rtype tcpip-forward want_reply 1 +debug1: server_input_global_request: tcpip-forward listen localhost port 0 +debug1: Local forwarding listening on ::1 port 0. +debug1: Allocated listen port 37515 +debug1: channel 2: new [port listener] +debug1: Local forwarding listening on 127.0.0.1 port 37515. +debug1: channel 3: new [port listener] +debug1: server_input_channel_open: ctype session rchan 0 win 1048576 max 16384 +debug1: input_session_request +debug1: channel 4: new [server-session] +debug1: session_new: session 0 +debug1: session_open: channel 4 +debug1: session_open: session 0: link with channel 4 + +debug1: Local forwarding listening on ::1 port 5555. +debug1: channel 0: new [port listener] +debug1: Local forwarding listening on 127.0.0.1 port 5555. +debug1: channel 1: new [port listener] +debug1: server_input_global_request: rtype tcpip-forward want_reply 1 +debug1: server_input_global_request: tcpip-forward listen localhost port 4444 +debug1: Local forwarding listening on ::1 port 4444. +debug1: channel 2: new [port listener] +debug1: Local forwarding listening on 127.0.0.1 port 4444. +debug1: channel 3: new [port listener] +debug1: server_input_channel_open: ctype session rchan 0 win 1048576 max 16384 +debug1: input_session_request +debug1: channel 4: new [server-session] +debug1: session_new: session 0 +debug1: session_open: channel 4 + +-------------------------------------------------------------------------------- + +[12:06] bento:openssh-6.2p1% grep SSH_CONNECTION -r * +audit-bsm.c: case SSH_CONNECTION_CLOSE: +audit.c: {SSH_CONNECTION_CLOSE, "CONNECTION_CLOSE"}, +audit.c: {SSH_CONNECTION_ABANDON, "CONNECTION_ABANDON"}, +audit.h: SSH_CONNECTION_CLOSE, /* closed after attempting auth or session */ +audit.h: SSH_CONNECTION_ABANDON, /* closed without completing auth */ +audit-linux.c: case SSH_CONNECTION_CLOSE: +monitor.c: case SSH_CONNECTION_CLOSE: +regress/proxy-connect.sh: SSH_CONNECTION=`${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 'echo $SSH_CONNECTION'` +regress/proxy-connect.sh: if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then +regress/proxy-connect.sh: fail "bad SSH_CONNECTION" +session.c: child_set_env(&env, &envsize, "SSH_CONNECTION", buf); +sftp-server.c: if ((cp = getenv("SSH_CONNECTION")) != NULL) { +sftp-server.c: error("Malformed SSH_CONNECTION variable: \"%s\"", +sftp-server.c: getenv("SSH_CONNECTION")); +ssh.0: SSH_CONNECTION Identifies the client and server ends of the +ssh.1:.It Ev SSH_CONNECTION +sshd.c: PRIVSEP(audit_event(SSH_CONNECTION_CLOSE)); +sshd.c: audit_event(SSH_CONNECTION_ABANDON); +[12:06] bento:openssh-6.2p1% + +-------------------------------------------------------------------------------- +debug1: Remote connections from LOCALHOST:5555 forwarded to local address localhost:22 + +-------------------------------------------------------------------------------- +[12:42] bento:openssh-6.2p1% grep tcpip-forward * +channels.c: packet_put_cstring("tcpip-forward"); +channels.c: packet_put_cstring("cancel-tcpip-forward"); +Binary file channels.o matches +grep: contrib: Is a directory +Binary file libssh.a matches +grep: openbsd-compat: Is a directory +grep: regress: Is a directory +grep: scard: Is a directory +serverloop.c: if (strcmp(rtype, "tcpip-forward") == 0) { +serverloop.c: debug("server_input_global_request: tcpip-forward listen %s port %d", +serverloop.c: } else if (strcmp(rtype, "cancel-tcpip-forward") == 0) { +serverloop.c: debug("%s: cancel-tcpip-forward addr %s port %d", __func__, +Binary file serverloop.o matches +Binary file ssh matches +Binary file sshd matches +Binary file ssh-keyscan matches +Binary file ssh-keysign matches +[12:42] bento:openssh-6.2p1% + +-------------------------------------------------------------------------------- +Channel information for (remote) forwarding: + + c = channel_new("port listener", type, sock, sock, -1, + CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, + 0, "port listener", 1); + c->path = xstrdup(host); + c->host_port = port_to_connect; + c->listening_addr = addr == NULL ? NULL : xstrdup(addr); + if (listen_port == 0 && allocated_listen_port != NULL && + !(datafellows & SSH_BUG_DYNAMIC_RPORT)) + c->listening_port = *allocated_listen_port; + else + c->listening_port = listen_port; + +-------------------------------------------------------------------------------- + +Code handling remote forwarding in the client: +- ssh_init_forwarding + - channel_request_remote_forwarding + Sends hostname + port for ssh1 only - not send in ssh2 + +Code handling forwarding / listening in the server: + +- channel_new: creates channels, 2 per listener (ipv4/ipv6) + - channels_alloc contains number of channels +- server_input_global_request + Reads only listen port, not hostname/port to connect to + - channel_setup_remote_fwd_listener + - channel_setup_remote_fwd_listener + +Code handling environment variables: + +- child_set_env +1236 child_set_env(&env, &envsize, "SSH_CONNECTION", buf); + From e55d328c9eadbd888d458fb32cb1433da9a3d451 Mon Sep 17 00:00:00 2001 From: Nico Schottelius Date: Mon, 3 Jun 2013 14:55:54 +0200 Subject: [PATCH 4/4] ++ideen Signed-off-by: Nico Schottelius --- docs/dev/logs/2013-05-17.ssh-callback-socat | 40 +++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 docs/dev/logs/2013-05-17.ssh-callback-socat diff --git a/docs/dev/logs/2013-05-17.ssh-callback-socat b/docs/dev/logs/2013-05-17.ssh-callback-socat new file mode 100644 index 00000000..69428309 --- /dev/null +++ b/docs/dev/logs/2013-05-17.ssh-callback-socat @@ -0,0 +1,40 @@ + +start ssh +to controlhost, +bind other side to +localhost:22 + + +targethost ------> ssh ------> controlhost + | + | + socat: connect stdin/stdout to ? + start cdist with port information + added + + +Use + +socat + + +-------------------------------------------------------------------------------- + TCP:: + Connects to [TCP service] on [IP address] using TCP/IP version 4 or 6 depending on address specifi‐ + cation, name resolution, or option pf. + Option groups: FD,SOCKET,IP4,IP6,TCP,RETRY + Useful options: crnl, bind, pf, connect-timeout, tos, mtudiscover, mss, nodelay, nonblock, sourceport, retry, + readbytes + See also: TCP4, TCP6, TCP-LISTEN, UDP, SCTP-CONNECT, UNIX-CONNECT + +forever +-------------------------------------------------------------------------------- +[root@nico-dev-vm-snr01 yum.repos.d]# ps aux | grep socat +nico 25035 0.0 0.0 41640 1524 ? Ss 13:27 0:00 socat - TCP-LISTEN:1234 +root 25037 0.0 0.0 103240 836 pts/1 S+ 13:27 0:00 grep socat +[root@nico-dev-vm-snr01 yum.repos.d]# + + + +-------------------------------------------------------------------------------- +