0

I have a Java App running, which prints out messages into STDOUT and also has an active interactive console (also accepts STDIN), when the server has started up.

How do I securely give access to an external person (outside the network) to the console and nothing else?

I was figuring using ncat --ssl -e java filenamehere

And setting a firewall rule for the port used to only allow packets from one origin:

iptables -I INPUT \! --src 1.2.3.4 -m tcp -p tcp --dport 777 -j DROP # if it's not 1.2.3.4, drop it

But is that secure?

In theory, IP spoofing can be used or are modern mitigation methods built into the OS? I tried setting nospoof on in the host.conf file but it seems that it's obsolete.

I was thinking of giving reverse-shell but that probably is a bit too much and insecure in my opinion. What is your opinion?

9
  • IP spoofing can be used to send packets, but it will not work to receive packets or complete a handshake ... – schroeder May 17 '20 at 12:45
  • host.conf doesn't apply ... – schroeder May 17 '20 at 12:48
  • why do you think reverse shell is insecure? – schroeder May 17 '20 at 12:49
  • Authentication is the way to provide connections and ensure that only authorised users can connect... Network-level controls have limitations. IP whitelisting suffers from the problem of IPs changing. – schroeder May 17 '20 at 12:50
  • @schroeder so IP spoofing can't be used to do a TLS handshake? I think reverse shell is insecure because arbitrary code could get executed on the server. How do I provide authentication then? Maybe something along the lines of nginx proxy basic auth, but then I would need to host it as a web page.. – Sir Muffington May 17 '20 at 12:58
1

Since IP addresses really aren't suitable for authentication, you should implement something else to do the job. A simple example in your scenario would be to write a wrapper script (executed by netcat or socat) that prompts for credentials. If the credentials are correct, it can then exec your Java program. This could be done in a few lines with a Bash script, e.g.:

#!/bin/bash

CORRECT_PASSWORD='h7a0&7;ngIl1+'
MYPROG="java filenamehere"
echo -n "Enter password: "
read -s pass

if [[ "$pass" == "$CORRECT_PASSWORD" ]]; then
    exec "$MYPROG"
else 
    echo Password incorrect
fi

You could run this in an endless loop with:

socat openssl-l:1234,reuseaddr,fork,certificate=cert.pem,keyfile=key.pem exec:/usr/local/bin/myscript

You do not need to worry about IP spoofing when using TCP in most cases, so whitelisting allowed addresses can be part of a defense-in-depth solution for your application.

Now, this is all assuming you fully trust the other person to use your application and your application is otherwise sufficiently locked down.

14
  • The problem is that the bash script running the app is a bit complicated and includes restart functionality (if the server crashes), backups etc. Also, could you explain the architecture a bit more? I am a bit confused about it. Could you give an example in bash then? – Sir Muffington May 17 '20 at 15:49
  • Maybe executing my script with auth included (not sure how I do that with bash maybe with expect?) with websocketd is a good solution? – Sir Muffington May 17 '20 at 15:51
  • @SirMuffington not sure what existing script you are talking about, but I added a very simple example – multithr3at3d May 17 '20 at 18:17
  • I guess I can exec the script instead of directly executing java etc. The script contains the java filename parameters etc in a bash function. It would also be awesome if you could explain the socat comma-separated parameters. – Sir Muffington May 17 '20 at 19:39
  • Also, does socat work across the internet? – Sir Muffington May 17 '20 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.