3

I have a server A in my local network in my house. I want to allow someone to come to that server using a reverse ssh connection from my server to his server from which he can get to my server. I don't want him to be able to get inside my local net and be able to login on any other computer else than the server I give him. Of course I don't want him to be able to install any root kits or ruin my systems and server in a way that I can't get it back. Is it possible that I give him an empty home directory to work within that directory with python and twitter API And vim and also be able to monitor his own processes and their resources and be able to kill his own processes. But not be able to go anywhere outside that directory or install things or discover my local network? Also I want to know if logging all of his activity with pam is reliable.

My only requirement for the user is: being able to use vim, interactive python3 session (the user only needs a handful of safe libraries), running python3 codes (the user only needs a handful of safe libraries), and be able to use all the bandwidth(to twitter website only), cpu(aal cores), and memory resources of the server.

Improve this question
2
  • I would start by checking out the technical documentation of your server and the OS you are running. That should give you a pretty good idea what you are dealing with. Maybe after that, you could focus your question on a specific point. This seems pretty broad.
    – Tom K.
    Jan 10, 2018 at 17:14
  • I'm using ubuntu 16.04
    – yukashima huksay
    Jan 10, 2018 at 17:35

4 Answers 4

Reset to default
5

... give someone a shell in my local net without security risks?

Dont

Instead of attempting to restrict shell access of this user I would recommend a completely different approach.

  • Purchase a second router
  • plug the internet of the new router to reg port of your existing router
  • port-forward port 22 from existing router to new router
  • port-forward port 22 from new router to server
  • setup SSH access for this un-trusted user on the server
  • restrict the server to twitter / developer / your external ip via the new router

this method is much safer / more reliable than a reverse shell this method allows the developer to use your external connection without having access to anything on your network (as long as he isnt able to exploit the new-router ... and you can monitor his traffic to make sure he isnt attempting to hack it) this method doesn't require any standing on head while patting belling to lock down a development environment while still allowing developer to do his job.

That being said, if you have existing stuff on the server that you want to protect from this user ... I would do a full clone of the server's hard-drive before letting them have access ... and then wipe it and restore from backup once they are done.

Physical access is root access, and while you are not technically giving this developer physical access ... shell access is pretty close to the same thing. If a hacker obtains shell access to an unprivileged user ... its common practice to nuke from orbit ... only way to be sure.

Improve this answer
0
2

All of the above is possible. I would suggest -

  • Create a user with minimal permissions. Explaining this in full is outside the scope of this stack exchange - look for something like server fault if you need help. This becomes harder if you want to restrict access to files that are otherwise readable/writable/executable for all users.
  • Create a restricted shell - see here.
  • Make sure PAM logs everything "session required pam_tty_audit.so enable=*"
  • To see processes "top -U [username]" or "ps -u [username]".

However there is one major problem here. Python. If the user can use python they can call executables via that. Some mitigation could be attempted using something like Sandboxed PyPy.

Saying this they should still only have read access to system files and restricted as per the OS user permissions. Beyond the usual "make sure your system is fully updated and you've not got any scripts/executables which are run as a privileged user writable by any user" the risk should be minimal.

Improve this answer
2

I dont't think that is a good idea at all. The propper way of doing it is usually to have a development machine (can be a vm) and a repository to which the code is submitted to. This scenario doesn't require any access to your environment. A development webserver can run with a gig of RAM and a virtual Core. So no cost there at all.

If that is not possible for a reason there are a few options out there. You can setup a new vm and put that vm in a separated vlan. Or you can leave it in that vlan and use private vlans to prevent the host from talking to any other machines on the lan apart from the gateway. You could also use containers to separate the app.

Improve this answer
2
  • In regards to which of the proposals?
    – davidb
    Jan 10, 2018 at 17:46
  • you could install Virtualbox in linux which would give access to all cores and ram (minus overhead of the VM) ... though this solution would not restrict his network access
    – CaffeineAddiction
    Jan 10, 2018 at 19:35
2

If you simply wanted to be able to see what the user did during their sessions, you could use an open source project called Teleport (see gravitational/teleport on github) to give them SSH access that is logged. It logs both audit events and everything done during any shell sessions.

The latest Teleport release has a "recording proxy" mode where even if you provided root on the end-point node, everything that happens during the session would be recorded by the proxy.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .