Re: Re: jails, ipfilter & stunnel

From: V. Jones (vjones62_at_earthlink.net)
Date: 07/14/03

  • Next message: Uwe Doering: "Re: jails, ipfilter & stunnel" 
    Date: Mon, 14 Jul 2003 12:39:50 -0400 (EDT)
To: freebsd-security@freebsd.org

    >No, no, no!

    >You first need to realize how kernel will choose listen socket.
    >If you bind to port 22 on main host with INADDR_ANY, you get this
    >INADDR_ANY, but if you bind to 22 port in jail even with INADDR_ANY
    >it will be translated to jail's ip. Now if there is open port outside
    >jail and inside some jail it is opened as well, guess which socket will
    >be chosen. Socket in jail, because it isn't INADDR_ANY (as I said kernel
    >translate them to jail's ip). So from security point of view if someone
    >will break into your jail, he is able to spoof your sshd (let's forget
    >for a moment about server keys), your mail server or anything >and get your password for example.

    >You can check my patch for multiple ips in jails which also fix
    >sockets ordering behaviour.

    > For FreeBSD 4.x:
    > http://garage.freebsd.pl/mijail.tbz
    > http://garage.freebsd.pl/mijail.README
    > For FreeBSD 5.1-CURRENT:
    > http://garage.freebsd.pl/mijail5.tbz
    > http://garage.freebsd.pl/mijail5.README
    > http://garage.freebsd.pl/patches/mijail5.patch

    I have a feeling you're trying to tell me something important
    but I'm not understanding. Is this a problem only with ssh or
    with any server listening on a port? Does this problem occur
    when you share an ip address between two jailed servers or does
    it happen any time you use a jail? Would having ssh on a
    different port on each jail avoid the problem?

    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

  • Next message: Uwe Doering: "Re: jails, ipfilter & stunnel"

    Relevant Pages

    • Re: jails, ipfilter & stunnel
      ... +>>I'm setting up a server where I plan to use Jails to improve security ... +> scenario) based on port numbers. ... You first need to realize how kernel will choose listen socket. ... but if you bind to 22 port in jail even with INADDR_ANY ...
      (FreeBSD-Security)
    • Re: multiple postgresql servers in multiple jails?
      ... I have a server runing two pgs. ... > Oliver Fromme wrote: ... >> because the SysV IPC IDs are derived from the port number. ... different jail. ...
      (freebsd-questions)
    • Re: multiple postgresql servers in multiple jails?
      ... > more than one postgres server? ... Yes, you must configure them to use different port numbers, ... all databases within the same server engine. ... in a different jail beside my production jail/pgsql-server to be sure ...
      (freebsd-questions)
    • Re: NAT Question
      ... > It is possible to use NAT in Windows 2000 Server to only translate a ... No. Win2000 RRAS-NAT (on Server) and the workstation ... version translate the entire address en bloc. ... You could block all but that port if that is what you want. ...
      (microsoft.public.win2000.ras_routing)
    • Re: NAT Question
      ... >> It is possible to use NAT in Windows 2000 Server to only translate a ... > version translate the entire address en bloc. ... >> I want to translate only the ssh port to the external network. ...
      (microsoft.public.win2000.ras_routing)