SSH Server : WinSSHD alternative on Linux

[zecas]

Hi,

Currently I'm in the process of making some changes on a small infrastructure that is composed of a few old physical machines which I want to virtualise.

One of those machines is an old Windows Server 2003, that has been hosting an SSH Server (WinSSHD, or Bitvise SSH Server, an old version by now).

I've been looking for a WinSSHD alternative that fits what I have now, since the software does not have a linux version, but that's been harder than I thought because of the features that WinSSHD provides and that I'm using.

For instance:
- Users are created in the software, no dependency on OS users, active directory or any other external tool (but ok, could accept a software that has integrated logins);
- For instance, "user-1" is allowed to login with certificate only, no session is allowed, so no access to any console (ok, this would be feasible in other alternatives);
- Then it is allowed to make a port forwarding only to 99.99.99.99:999, which does not exist on the network;
- The SSH server accepts that 99.99.99.99:999 target defined internally as an alias, then connects to the real IP address, for instance 10.10.1.100:3389 (let's say for example it was a RDP connection).

So this way:
1- the client can only connect with it's user and certificate (public key on the server),
2- then it is only allowed to make a port forwarding to a very specific non-existant iport destination, which does not expose any details about the target network infrastructure,
3- then the SSH server internally maps that alias to the correct iport on the network,
4- this even allows me to change target server IP with no impact on the client, I would only need to reconfigure the alias on SSH server.

I would like to not depend on a windows machine for this service, and on the limit, I could even test running the software on wine, as a last resort alternative before getting stuck with windows.

Still having a native linux solution would be way better, bu from what I've read, setting up an SSH server on a linux will not give me this features I currently use, or would it be possible to do it?

Thanks

 

[oneplane]

All of this is possible with bog standard openssh, the extra parts you are doing are not really SSH stuff but more like D-NAT (or just use DNS?).

1. This is standard and already present on any BSD, Unix and Linux installation for decades
2. This is supported (per-user, but also per-source, per-destination etc.) by default as well; but how a 'fake' IP translates to a 'real' IP is the job of nftables/iptables/pf
3. Not part of SSH
4. This should probably be DNS, not D-NAT, either way, not part of SSH, and it's something you can do with standard nftables/iptables/pf

The configuration items you'd be looking for are:
AllowUsers
AllowGroups
AllowTcpForwarding

And:

PermitOpen
Specifies the destinations to which TCP port forwarding is permitted. The forwarding specification must be one of the following forms:

PermitOpen host: port
PermitOpen IPv4_addr: port
PermitOpen [IPv6_addr]: port

They can be scoped to users and hosts so you can make it as fine-grained as you want. As for where those users (and their keys) are stored: you can use standard linux users that have no permissions and just use those. If you really don't want to, you can configure any user source you want from the available PAM modules. This includes just hash files which essentially is the same thing as standard users, but in a separate file.

If what you're trying to build is a poor man's VPN: maybe just make a VPN server? If there is no need for shell access, a VPN makes it really easy to push whatever routes you want to expose, and if you want a GUI, the likes of OpenVPN-AS make a WebGUI powered thing with local users and logging certificates etc. You specify which user gets access to what, and how they log in, and they just use standard software for network connections (including the standard OpenVPN CLI and OpenVPN Connect GUI).

If you do want shell access, ssh is probably still the best option.