For this lab, we need to configure an SSH SOCKS5 proxy as a jump point. There are several key things we need to do. First, we need to allow traffic only on port 61613 and only from one IP address. SSH must run on port 61613. Next, we must verify the configuration is valid. Another thing to pay attention to is that the client can use the server as a SOCKS5 proxy.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Generate a Private/Public Key Pair
This is necessary to use for authentication against the server on the client.
ssh-keygen- Configure the JumpPointServer
Change the SSH Port from 22 to 61613,
PermitRootLogintono, andPubkeyAuthenticationtoyes.sudo vim /etc/ssh/sshd_configPort 61613 PermitRootLogin no PubkeyAuthentication yesESC :wq ENTER- On the JumpPointServer Inform SELinux of the Change of Ports and Configure firewalld to Allow Port 61613 for SSH
Inform SELinux of the Change of Ports
sudo semanage port -a -t ssh_port_t -p tcp 61613Configure firewalld to Allow Port 61613 for the SSH Service
sudo vim /usr/lib/firewalld/services/ssh.xml<port protocol="tcp" port="61613"/>ESC :wq ENTERReload firewalld
sudo firewall-cmd --reloadCopy the Public Key from the Client to
/home/cloud_user/authorized_keysRestart SSHD
sudo systemctl restart sshdLog Back into the JumpPointServer
- On the JumpPointServer Generate a Key Pair for the ContainerServer
ssh-keygenCopy the Public Key from JumpPointServer to the Following Location on the ContainerServer
/home/cloud_user/authorized_keys- Configure the ContainerServer
Change the SSH Port from 22 to 61613,
PermitRootLogintono,PubkeyAuthenticationtoyes.sudo vim /etc/ssh/sshd_configPort 61613 PermitRootLogin no PubkeyAuthentication yesESC :wq ENTER- On the ContainerServer Inform SELinux of the Change of Ports, Configure firewalld to Allow Port 61613 for SSH
Inform SELinux of the Change of Ports
sudo semanage port -a -t ssh_port_t -p tcp 61613Configure firewalld to Allow Port 61613 for SSH Service
sudo vim /usr/lib/firewalld/services/ssh.xml<port protocol="tcp" port="61613"/>ESC :wq ENTERReload firewalld
sudo firewall-cmd --reloadLog Back Into the ContainerServer from the JumpPointServer
- Allow Access Only from the JumpPointServer
sudo firewall-cmd --permanent --zone=public --add-rich-rule=' rule family="ipv4" source address="<IP or NETWORK>" port protocol="tcp" port="<PORT_NUMBER>" accept'sudo firewall-cmd --reloadRestart SSHD
sudo systemctl restart sshd
Close Off SSH for Others
sudo firewall-cmd --permanent --remove-service=ssh- Optional – Open a SOCKS5 Proxy from Our Client to the JumpPointServer
ssh -D 1337 -q -C -N -f cloud_user@IPConfigure Our Browser Proxy Settings to Make Use of the SSH Tunnel
PORT: 1337 ADDRESS: localhost or 127.0.0.1On Firefox This Can Be Configured under Network Settings
