[SOLVED] sshd and dynamic dns

silvik · 2011-03-09 23:35:46

I have ssh installed at home and works ok if I use IP addresses in /etc/hosts.allow, but I can't get it to connect with no-ip hostnames (I have a dynamic ip) - if I use in /etc/hosts.allow sshd: MY.NUMERIC.IP.ADDR : allow it's ok, but sshd: HOMEHOST.zapto.org : allow it's not (I want to restrict login to a few whitelisted hosts)
no-ip updater works fine, but for now I have to login at no-ip website, copy the current addr and ssh there... I'm lucky that my work host has a static IP.
Thanks for any ideas.

sshd_config

#    $OpenBSD: sshd_config,v 1.82 2010/09/06 17:10:19 naddy Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options change a
# default value.

Port 41414
AddressFamily inet
ListenAddress 192.168.100.200
#ListenAddress ::

# The default requires explicit activation of protocol 1
Protocol 2

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 1h
ServerKeyBits 2048

# Logging
# obsoletes QuietMode and FascistLogging
SyslogFacility AUTH
LogLevel INFO

# Authentication:

LoginGraceTime 1m
PermitRootLogin no
StrictModes yes
MaxAuthTries 1
MaxSessions 2

RSAAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile    .ssh/authorized_keys

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no
PermitEmptyPasswords no

# Change to no to disable s/key passwords
ChallengeResponseAuthentication yes

# Kerberos options
KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

# Set this to 'yes' to enable PAM authentication, account processing, 
# and session processing. If this is enabled, PAM authentication will 
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
TCPKeepAlive yes
UseLogin no
UsePrivilegeSeparation yes
PermitUserEnvironment no
Compression yes
#ClientAliveInterval 0
#ClientAliveCountMax 3
UseDNS yes
#PidFile /var/run/sshd.pid
MaxStartups 2
#PermitTunnel no
#ChrootDirectory none

# no default banner path
Banner none

# override default of no subsystems
Subsystem    sftp    /usr/lib/ssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#    X11Forwarding no
#    AllowTcpForwarding no
#    ForceCommand cvs server

AllowUsers sshsilvik

/etc/hosts.allow

#
# /etc/hosts.allow
#

#doesn't work
#sshd: HOMEHOST.zapto.org : allow
#sshd: WORK.zapto.org : allow

#works fine
sshd: IP.OF.FIRST.HOST : allow
sshd: IP.OF.SECOND.HOST : allow

# End of file

/etc/hosts/deny

#
# /etc/hosts.deny
#

ALL: ALL: DENY

# End of file

Last edited by silvik (2011-03-11 11:27:41)

useradded · 2011-03-10 09:24:05

Hi

I was intrigued by this as I play with ssh a fair bit myself, so I had a look around and found this which I think explains the problem:

http://forum.dyndnscommunity.com/forum/ … 8&start=10

Basically, when the ssh server checks out the identity of a client attempting to connect, it does a reverse DNS lookup and finds the client's IP address, e.g. ipaddress@isp.com. Of course, this will only match what's in hosts.allow, if hosts.allow actually contains that IP address. If instead, hosts.allow contains a dyndns alias, then it will not match and access will be denied.

Last edited by useradded (2011-03-10 09:24:59)

barto · 2011-03-10 14:13:45

Try this:

sshd: ALL@HOMEHOST.zapto.org : allow
sshd: ALL@WORK.zapto.org : allow

silvik · 2011-03-10 21:50:35

thanks. I'll try barto's idea tomorrow, but after reading useradded's link my hopes are low.

silvik · 2011-03-10 22:14:44

sshd: ALL@HOMEHOST.zapto.org : allow doesnt work, probably it's the same thing as sshd: HOMEHOST.zapto.org : allow. also UseDNS no directive in sshd_config doesnt work

but I noticed something along the lines of useradded's link. if I add a line in /etc/hosts with the ip that is pointed by the dynamic dns addr everything suddenly works with dynamic names. of course this kinda defeats the purpose of having dynamic dns. except if I run a cron job that updates the withelisted hosts in /etc/hosts from dns queries.

or maybe I'll just drop this whole whitelist idea (I still think is cleaner) and use denyhosts/keys like everyone else.

silvik · 2011-03-11 11:26:08

I quit trying to use dynamic dns hostnames and took a different approach, whitelisting a host in host.allow by IP using gmail.
Basically I send myself an email and a cron job updates hosts.allow every 5 minutes or so.
If someone is interested here is the script - 4 lines

#!/bin/bash
# Cron script to whitelist hosts for sshd access using gmail's https atom feed
# Update GMAILUSER/GMAILPASSWD vars and chmod 700 root:root, because the password is in clear text
# Use cron to run it periodically (I use 5 min)
#
# To add a host in whitelist send yourself an email using GMAILUSER account with a subject like: sshd 8.8.8.8 whitelist
# To remove a host from whitelist read or delete the corresponding email. The feed shows only unread mail
#
# The script works by updating hosts.allow. It checks the feed  for mails from us and subject like sshd 8.8.8.8 whitelist
# The whitelist stored in hosts.allow, between 2 markers (GMAIL WHITELIST, END WHITELIST), dont remove them
# Other entries in hosts.allow that arent between markers will not be affected


GMAILUSER="ACCOUNT NAME"
GMAILPASSWD="PASSWORD"


#remove old whitelist
perl -ni -e 'print unless(/GMAIL WHITELIST/../END WHITELIST/)' /etc/hosts.allow

echo "#GMAIL WHITELIST" >> /etc/hosts.allow

curl -u $GMAILUSER:$GMAILPASSWD --silent "https://mail.google.com/mail/feed/atom" | tr -d '\n' | \
awk -F '<entry>' '{for (i=2; i<=NF; i++) {print $i}}' | sed -n "s/<title>\(.*\)<\/title.*email>\(.*\)<\/email>.*/\2 - \1/p" | \
grep "^$GMAILUSER@gmail.com - sshd" | cut -d- -f2 | sed 's/ sshd/sshd :/g' | sed 's/whitelist/: allow/g' >> /etc/hosts.allow

echo "#END WHITELIST" >> /etc/hosts.allow

Last edited by silvik (2011-03-11 11:28:15)

kgas · 2011-03-11 15:32:56

or you can use avahi to get the host name and other. If you are in the same network you can use hostname.lan ie ssh username@hostname.lan will work.

silvik · 2011-03-11 17:27:21

oh, so that's what avahi is for.. I always disable it :d not the same network though.

I like the gmail solution to this problem, I can account every login, and the service is available on demand from anywhere with default deny policy, without having problems like distributed bruteforce attempts, not having the stick with the ssh keys with you when needed etc for 4 lines of shell code.

Officially closed topic. Thank you all.

Last edited by silvik (2011-03-11 17:28:54)

Arch Linux

#1 2011-03-09 23:35:46

[SOLVED] sshd and dynamic dns

#2 2011-03-10 09:24:05

Re: [SOLVED] sshd and dynamic dns

#3 2011-03-10 14:13:45

Re: [SOLVED] sshd and dynamic dns

#4 2011-03-10 21:50:35

Re: [SOLVED] sshd and dynamic dns

#5 2011-03-10 22:14:44

Re: [SOLVED] sshd and dynamic dns

#6 2011-03-11 11:26:08

Re: [SOLVED] sshd and dynamic dns

#7 2011-03-11 15:32:56

Re: [SOLVED] sshd and dynamic dns

#8 2011-03-11 17:27:21

Re: [SOLVED] sshd and dynamic dns

Board footer