[Solved] Can iptables help support app that does not provide auth?

Gregosky · 2017-05-07 00:13:12

Hi all,

Short question: is it possible to make iptables to drop `unauthenticated` traffic?

Long story:

What I have in mind is to make iptables to use i.e. password that would be exchanged before communication can be established.

I know this question does probably make no sense, but I'm trying to add authentication to application that does not support it (that is - application which would otherwise accept any client to connect).

I'm dealing with postgres-xl, very interesting fork of postgresql which makes big data analysis easier.

Though I have this problem - after weeks of research and reading through their mailing lists and code it seems postgres-xl nodes just do not support any kind authentication between each other. SSL is not supported neither.

My private network I'm setting up on ensures MITM attacks are not possible so for the time being I can live without point-to-point encryption.

But I cannot live without some sort of authentication... Somebody could simply pick up one of my IP addresses and attempt to communicate to my database. I don't like that.

I have been thinking how to overcome this and OpenVPN was one of my possible picks. Unfortunately it is not possible to have truly p2p OpenVPN, traffic will always go through single OpenVPN server which pretty much destroys performance foro the cluster.

Please help,
Greg

Last edited by Gregosky (2017-05-13 23:41:04)

sbmomeni · 2017-05-07 08:31:38

A simple workaround:
1. Configure the database to listen on localhost (so no remote computer can connect to it),
2. Use `ssh -fNL 1234:127.0.0.1:1234 user@serverip` command (replacing 1234 with your database port number) to forward your local 1234 port to the server 1234 port,
3. Connect to 127.0.0.1:1234 instead of serverip:1234

Gregosky · 2017-05-07 15:01:04

@sbmomeni - I know this workaround (since it's described in postgresql documentation) and this is not solving my problem. The procedure you copied here applies for clients connecting to the postgresql server. I'm trying to secure inter-node communication of postgres-xl, which is much more complex than just to create one tunnel. In my case I have, say, 4 nodes in which case I would have to create a full mesh of ssh tunnels. Although this might resolve my immediate issue I would fall into a problem of managing this full mesh :-) If I add one more node I have to visit each node and create tunnel on each to that new node (and vice versa). This will be a nightmare when I reach, say, 10 nodes (and more)...

Thanks anyways :-)

brebs · 2017-05-07 15:43:45

Gregosky wrote:

My private network I'm setting up on ensures MITM attacks are not possible so for the time being I can live without point-to-point encryption.
But I cannot live without some sort of authentication... Somebody could simply pick up one of my IP addresses and attempt to communicate to my database.

Isn't your "private network" *firewalled*? Are your database servers publicly accessible?

stunnel is another app to consider.

Gregosky · 2017-05-08 09:30:17

Hi @brebs - yes, the private network is firewalled however each VPS gets two IP addresses - public and private. I do not expose database on public IP.

IP addresses are assigned by hosting provider and even though hosting provider says people cannot assign my IP addresses to their VPSes I am not sure how much trust can I put in it...

Many thanks for pointing to stunnel, from their `about` section - " Stunnel is a proxy designed to add TLS encryption functionality to existing clients and servers without any changes in the programs' code." - which sounds like very interesting option to investigate. And it is available through pacman!

Last edited by Gregosky (2017-05-08 09:31:48)

R00KIE · 2017-05-08 11:22:24

From what I've seem about stunnel it is point to point but you'll go through the same trouble of setting up everything as with openvpn if you make it a point to point vpn.

I suppose that if you have many nodes it will be a pain to setup and maintain, specially if you want to do mutual authentication of peers, which means managing your own CA and all the certificates just like with openvpn.

You say you need true p2p so unless I'm seeing it wrong you would have to setup a server on each node and set each node as a client for all other nodes, I can imagine that getting out of hand quite quickly.

All that said, if you don't mind testing something that is claimed not to be production quality yet (and may have security issues) you could take a look at wireguard[1], it might be easier to manage than openvpn/stunnel (or not). It will not be as convenient as stunnel or openvpn since it is not in the official repos.

[1] https://www.wireguard.io/

Lone_Wolf · 2017-05-09 20:02:55

Gregosky,
your description sounds like you need a router / firewall combination .

example how this could work :

the router will be connected to 3 networks.

internet : the public network
private1 : 192.168.0.0/24 for your normal devices
private2 : 10.0.0.0/24 for the nodes

You setup your router / firewall so that only traffic from specific addresses using specific ports is allowed to enter the private2 network.

It can be done through iptables, setting this up may be tricky and cumbersome though.
Several years ago I occasionally used a frontend called fwbuilder to create iptables rules for similar setups.

Gregosky · 2017-05-13 23:25:30

Hi @rookie and @Lone_Wolf,

Many thanks for your great advice. In the end my VPS provider informed me, that they plan rolling out private VLANs so this will solve my problem. I'd love to add authentication to postgres-xl and maybe once I'm done with my work I will contribute :-)

I also managed to harden postgres-xl as much as it seems possible. Namely allowing traffic only from speciffic IP addresses and also binding to speciffic interfaces.

Thank you all for valuable hints!

jasonwryan · 2017-05-13 23:31:25

Please do not use [Closed], it denotes a locked post. Use [Solved] or [Resolved] instead.

Gregosky · 2017-05-13 23:42:37

My problem cannot be really solved (or at least not easily, it's beyound my capability to craft some viable solution). I mark it as requested however it's not really solved.

Arch Linux

#1 2017-05-07 00:13:12

[Solved] Can iptables help support app that does not provide auth?

#2 2017-05-07 08:31:38

Re: [Solved] Can iptables help support app that does not provide auth?

#3 2017-05-07 15:01:04

Re: [Solved] Can iptables help support app that does not provide auth?

#4 2017-05-07 15:43:45

Re: [Solved] Can iptables help support app that does not provide auth?

#5 2017-05-08 09:30:17

Re: [Solved] Can iptables help support app that does not provide auth?

#6 2017-05-08 11:22:24

Re: [Solved] Can iptables help support app that does not provide auth?

#7 2017-05-09 20:02:55

Re: [Solved] Can iptables help support app that does not provide auth?

#8 2017-05-13 23:25:30

Re: [Solved] Can iptables help support app that does not provide auth?

#9 2017-05-13 23:31:25

Re: [Solved] Can iptables help support app that does not provide auth?

#10 2017-05-13 23:42:37

Re: [Solved] Can iptables help support app that does not provide auth?

Board footer