FreedomBoxBlog

On my FreedomBox I want SSH access from the internet for the following reasons:

• My FreedomBox is designed to be shared with family and friends, any user can get his/her own private virtual machine(s). To remotely manage a virtual machine SSH access is needed.
• SSH can be used as a secure inter – FreedomBox communication channel.

Using virtual machines complicates the use of SSH. Each virtual machine has its own IP address, and the FreedomBox only has one external IP address. There must be a way to connect this external address to one of the many internal addresses. Fortunately SSH is very flexible and it is possible to do this very elegantly.

Read this first.

This article is one in a series that describes the building of my FreedomBox. Not all information from the previous articles is repeated.

The method.

On my FreedomBox the external IP address is connected to a special virtual machine which I call the internet module. This internet module acts as a gateway to the host system and all the other virtual machines.

[client (A)] --> Internet --> [internet module (IM)] -->  n*[virtual machine (B)]

If you want a SSH connection from client A to a virtual machine B then you need two SSH connections. First you have to make a connection from A to an account on the internet module (IM). From this connection you can make a second connection from IM to B. Making connections this way is not transparent. Machine A does not know it’s connected to machine B, machine B does not know it’s connected to machine A. Because the machines are not connected directly some SSH commands do not behave normally, or may not work at all.

Fortunately there is an elegant way to let both machines think they have a direct connection. For this you have to use the ProxyCommand statement in the ~/.ssh/config configuration file. With this statement you can specify a shell command that makes the connection to the remote system. The SSH client then uses the resulting stdin/stdout of the command as a channel to the remote SSH server.

For a transparent connection the returned stdin/stdout must be connected to the SSH port of the target server. The tick to get this done involves the following steps. First make a connection to the gateway system. On the gateway system start a program that returns a connection to the target system. Return this connection to the client.

Enough theory, here’s the ~/.ssh/config setting I use to connect to my freedomboxblog VM over the internet:

Host freedomboxblog
  ProxyCommand ssh -p 99999 -qax guest@freedomboxblog.nl nc -w 1 freedomboxblog.freedom.box 22

I use ssh to log-in on the guest account of my internet module. Then the netcat program is used to make a connection to the freedomboxblog VM. This connection is returned and used by the SSH client to connect to “host freedomboxblog”.

On the internet module I only allow RSA authentication for the guest account. This is not only the most secure way, but it also prevents the password pop-up. With RSA authentication it is not possible to log-in if you don’t have the private key. Unfortunately many people still try to log in by brute force. To prevent these attacks I use a non-standard SSH port (see my firewall article).

The configuration.

Client side:

cd ~/.ssh

Edit the config file, add the following lines:

Host myhost
  ProxyCommand ssh -p 99999 -qax guest@mydomain.com nc -w 1 myhost.freedom.box 22

Create RSA authentication keys:

ssh-keygen

This command creates two keys with your username. The one ending with .pub is needed by the internet module on the FreedomBox.

scp yourusername.pub root@internet.freedom.box:~

The internet module.

ssh root@internet.freedom.box

Install netcat:

apt-get install netcat

Create a guest user:

useradd -m guest
cd /home/guest

Add your public key to the authorized users of this account:

mkdir .ssh
cd .ssh
cat /root/yourusername.pub >> authorized_keys

Edit /etc/ssh/sshd_config so it has the following settings:

PasswordAuthentication no
AllowUsers guest

Restart ssh:

/etc/init.d/ssh restart

Now you can only log-in using the guest account, and only if you have one of the private keys belonging to the public keys in /home/guest/.ssh/authorized_keys.

The next time you try:

ssh root@internet.freedom.box

you get:

Permission denied (publickey).

So in order to get root access you first have to log-in to the guest account and then use the su command.

Something every FreedomBox should have is a firewall combined with NAT functionality. These functions are provided by every router, so why not let the router take care of these functions? There are several reasons against using the router for these functions:

• Firewall and NAS functions are of vital importance for the security of a FreedomBox. These functions should therefore be implemented on the FreedomBox hardware and not be delegated to third party hardware. Most routers don’t come with source code or hardware specs and cannot be fully trusted.
• The FreedomBox cannot control the firewall or NAT of a particular router. There are just too many different brands and models. As a device for non technical users the FreedomBox cannot ask the user to manage the router firewall and NAT every time a new program is (de-)installed.
• Having a firewall on the FreedomBox gives us the possibility to log attacks and implement our own counter measures.

Read this first.

This article is one in a series that describes the building of my FreedomBox. Not all information from the previous articles is repeated.

A short overview of my FreedomBox architecture.

In order to understand the configuration of the firewall you need to have a high level view of the architecture of my FreedomBox. In my architecture I use virtual machines (Linux Containers: LXC) that are all part of the same bridged network br0. All VM’s use DHCP to get an IP address. There are two static IP addresses:

192.168.1.3

This is the address of the br0 interface. (a.k.a. the internal address of my FreedomBox)

192.168.1.10

This address belongs to a special VM: the internet module. The internet module is a so called bastion host. A bastion host is a special hardened system that is placed in the DMZ of the router as a gateway to the internal systems (or programs).

In my architecture I try to run every service that is connected to the internet inside its own VM. Access from the internet to a service inside a VM always passes the internet module first.

Sometimes it is not possible to run a service inside a VM. In that case I use NAT to route incoming requests from the DMZ (IP: 192.168.1.10) to the host system (IP: 192.168.1.3). At the moment OpenVPN is the only service connected to the internet that is running directly on the host.

Objectives.

Installing a firewall/NAT should accomplish the following:

• Strengthen the isolation of the VM’s.
• Make it possible to have firewall settings for a single VM or a group of VM’s.
• Prevent VM’s to access services on the host system except for some necessary services.
• Create routes for traffic that cannot be routed by the internet module.
• Make it possible to run services on non standard ports.
• Forward traffic to other FreedomBox systems.
• Logging attacks.

Some small adjustments.

In order to integrate the firewall into my FreedomBox I had to make the following changes to my setup:

• Add a vendor class identifier to the DHCP request of a LXC module.
• Use the vendor class identifier to give LXC modules IP addresses from a separate DHCP range.

For the vendor class identifier I changed my lxc-debian-box script. Click the link for the update. If you have already made some LXC modules you can bring them up to date by adding the following line to the /etc/dhcp/dhclient.conf file inside the container:

send vendor-class-identifier "lxc.module";

The vendor-class-identifier is used by dnsmasq. The file /etc/dnsmasq.conf should be edited as follows:

change:

dhcp-range=192.168.1.10,192.168.1.250,12h

to:

dhcp-vendorclass=set:lxc,lxc.module
dhcp-range=net:lxc,192.168.1.10,192.168.1.50,12h
dhcp-range=192.168.1.100,192.168.1.150,12h

Restart dnsmasq and all the containers to activate the changes.

Installing Shorewall.

On my FreedomBox I use Shorewall for the firewall/NAT functions. It is a very mature and flexible program. Installing is simple:

apt-get install shorewall

Configuring Shorewall.

Shorewall is well documented so I only give a quick overview before presenting my Shorewall configuration.

Central in the Shorewall configuration is the concept of zones. A zone is one-to-one coupled to a network interface. If it is necessary to have multiple zones within the same network (this is the case with my FreedomBox) you can specify sub-zones. Only traffic between different (sub-)zones is examined by the firewall. Default actions for inter-zone traffic are specified by a policy. Exceptions to the policy are specified by rules.

All Shorewall configuration files are in the directory /etc/shorewall. After installing this directory only has one file (shorewall.conf) in it that does not have to be changed. The actual configuration is in the files:

• interfaces – specifies network interface <> zone relations.
• zones – defines zones and sub-zones
• hosts – specifies sub-zones
• policy – the default actions for inter-zone traffic
• rules – the exceptions to the policy
• tunnels – needed for VPN
• routestopped – specifies the state after Shorewall is stopped.

I have the following configuration:

interfaces

#ZONE   INTERFACE     BROADCAST     OPTIONS

net     br0           detect        bridge,dhcp
vpn     tap0

On my system there are two network interfaces. Br0 is placed in the net zone, this zone represents the internet. For OpenVPN I have a second zone (I will write about my OpenVPN configuration in a next article)

zones

#                                 IN          OUT
#ZONE       TYPE      OPTIONS     OPTIONS     OPTIONS

fw          firewall
vpn         ipv4

net         ipv4
loc:net     ipv4
vmnet:net   ipv4
imod:vmnet  ipv4

The fw zone is a special firewall zone. Think of “fw” as the system on which Shorewall runs. The net zone is split in tho sub-zones: loc and vmnet. Loc stands for all the systems that are not VM’s, those systems are in the vmnet zone. One special VM, the internet module, is placed inside its own imod sub-zone.

hosts

#ZONE     HOST(S)                           OPTIONS

imod      br0:192.168.1.10
vmnet     br0:192.168.1.11-192.168.1.50     routeback
loc       br0:192.168.1.100-192.168.1.150   routeback

This file has all the sub-zones

policy

#SOURCE	    DEST     POLICY     LOG LEVEL     LIMIT:BURST

net         all      DROP       info

imod        vmnet    ACCEPT
imod        all      REJECT     info

vmnet       net      ACCEPT
vmnet       all      REJECT     info

loc         all      ACCEPT
$FW         all      ACCEPT
vpn         all      ACCEPT

# The FOLLOWING POLICY MUST BE LAST

all         all      REJECT     info

The policies are examined from top to bottom and the first match cancels further processing of policies. You can see that no traffic from the net zone to any other zone is allowed by the default policy. The exceptions to the policies are in the rules configuration file.

rules

#                                                           DEST     SOURCE     ORIGINAL     RATE     USER/     MARK
#ACTION        SOURCE      DEST                     PROTO   PORT     PORT(S)    DEST         LIMIT    GROUP

SECTION NEW

Ping(DROP)     net         all

# enable DHCP and DNS access for zones on the freedombox

ACCEPT         imod        $FW                      udp     67:68
DNS(ACCEPT)    imod        $FW

ACCEPT         vmnet       $FW                      udp     67:68
DNS(ACCEPT)    vmnet       $FW

ACCEPT         loc         $FW                      udp     67:68
DNS(ACCEPT)    loc         $FW

# enable HTTP and SSH access, use a non-standard port for SSH

ACCEPT:info    net         imod                     tcp     http
DNAT:info      net         imod:192.168.1.10:22     tcp     99999

# enable OpenVPN

DNAT:info      net         fw:192.168.1.3:1194      udp     1194

The only traffic from the net zone to my FreedomBox is HTTP, SSH and OpenVPN traffic.

It’s amazing how many people try a brute-force attack on your SSH port. Even if you clearly indicate that it is only possible to login with RSA. I got very annoyed by the constant flickering of my lan-light so for SSH i’m using a non-standard port (not port 99999 ).

tunnels

#TYPE                ZONE    GATEWAY      GATEWAY_ZONE

#openvpnserver:1194  net     0.0.0.0/0

routestopped

#                                               DEST      SOURCE
#INTERFACE     HOST(S)    OPTIONS     PROTO     PORTS     PORTS

br0            -          source

Running Shorewall

With the configuration in place Shorewall can be started. The Debian packagers have wisely prevented Shorewall to start by default. For this you have to edit /etc/default/shorewall and change the startup configuration option. Shorewall is a very flexible program. This flexibility comes at a price: it is very easy to make a mistake, and mistakes can lock you out. I think it is best to start Shorewall manually. If you make a mistake you can correct the error after restarting the system.

Until now everything I built was “just infrastructure”. The WordPress module is the first module that uses the infrastructure. Building a WordPress module as the first “real” module had two reasons. First: I need the module to house this blog . Second: the configuration and data inside the module is reasonably complex. This makes it ideal to develop and test the data-interface of my FreedomBox architecture.

Creating a WordPress module consists of the following steps:

• Create a LXC container to house the module.
• Install MySQL.
• Install PHP & Co.
• Install a Mail Transfer Agent (Exim4).
• Install and configure WordPress.
• Configure Apache.
• Configure the internet module.

Read this first.

This article is one in a series that describes the building of my FreedomBox. Information from the previous articles like network and software configuration is not repeated.

Create a LXC container to house the module.

cd /var/lib/lxc
mkdir wordpress
/usr/lib/lxc/templates/lxc-debian-box -n wordpress -p /var/lib/lxc/wordpress

Start the container and continue installation.

lxc-start -n wordpress -d

Login (password = root)

ssh root@wordpress.freedom.box

Inside the container issue the following commands:

passwd
dpkg-reconfigure tzdata
dpkg-reconfigure locales
apt-get update
atp-get upgrade

Choose both a locale and default locale (my system: es_US.UTF-8).

Install MySQL.

apt-get install mysql-server

Install PHP & Co.

apt-get install php5 php5-mysql php-apc

Installation of PHP triggers the installation of Apache2. The php-apc package caches the byte codes of the PHP interpreter. This makes PHP execution much faster.

Install the Exim4 MTA.

WordPress needs a MTA to send notifications to the blog admin/user. I use a version of Exim4 that is probably way too powerful for this simple task.

apt-get install exim4-daemon-heavy

After installation you can use the following command to configure Exim4:

dpkg-reconfigure exim4-config

Most configurations should be “mail send by smarthost”.

Install and configure WordPress.

I found the Debian WordPress configuration a little bit confusing so I decided to install the official version:

apt-get install wget

cd /var/www

wget http://wordpress.org/latest.tar.gz
tar xfvz latest.tar.gz

Create a WordPress database:

mysql -u root -p 

mysql> CREATE DATABASE wordpress;
mysql> GRANT ALL PRIVILEGES ON wordpress.* TO 'wordpress'@'localhost' IDENTIFIED BY 'password';
mysql> FLUSH PRIVILEGES;
mysql> exit

Change the password in the line with the privileges statement (do not remove the quotes).
Create and edit a wp-config.php:

cd /var/www/wordpress
cp wp-config-sample.php wp-config.php

Install your favorite text editor and edit wp-config.php. Change the MySQL settings and use the link in the “Authentication Unique Keys and Salts” section to get unique values.

The www-data user needs to be the owner of /var/www/wordpress.

cd /var/www/wordpress
chown -R www-data:www-data *

Remember: every time you edit one of the files in the wordpress directory you have to change the ownership to www-data afterwards.

Configure Apache2.

In my FreedomBox every request to Apache comes from the Nginx web-server in the internet module. Therefore Apache thinks that every request comes from the same IP address. This must be corrected otherwise things like logging and surveys won’t work as expected. To correct the IP address mod_rpaf must be installed and configured:

apt-get install libapache2-mod-rpaf
cd /etc/apache2/mods-enabled

Edit rpaf.conf. Add the IP address of the internet module (192.168.1.10) to RPAFproxy_ips.
Make a symbolic link to mod_rewrite so you can have “pretty urls” in WordPress:

ln -s ../mods-available/rewrite.load

Create a file with the name wordpress inside the directory /etc/apache2/sites-available
The file should contain something like:

<VirtualHost *:80>
	ServerAdmin yourname@yourdomainname.com
	ServerName wordpress.yourdomainame.com 
	DocumentRoot /var/www/wordpress

	<Directory />
		Options FollowSymLinks
		AllowOverride None
	</Directory>

	<Directory /var/www/wordpress>
		Options Indexes FollowSymLinks MultiViews
		AllowOverride All
		Order allow,deny
		allow from all
	</Directory>

	ErrorLog ${APACHE_LOG_DIR}/error.log
	# Possible values include: debug, info, notice, warn, error, crit,
	# alert, emerg.

	LogLevel warn
	CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Change both ServerAdmin and ServerName.
Enable the site by creating a symbolic link in /etc/apache2/sites-enabled and by restarting the Apache web-server.

cd /etc/apache2/sites-enabled
ln -s ../sites-available/wordpress
apache2ctl restart

Configure the internet module to forward requests to the WordPress module.

Logout from the WordPress module and connect to the internet module:

ssh root@internet.freedom.box

Edit the Nginx configuration in /etc/nginx/nginx.conf. Make it look like:

user  www-data; 
worker_processes  1; 

#error_log  logs/error.log; 
#error_log  logs/error.log  notice; 
#error_log  logs/error.log  info; 
#pid        logs/nginx.pid; 

events { 
    worker_connections  1024; 
} 

http { 
    include       mime.types; 
    default_type  application/octet-stream; 

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" ' 
                      '$status $body_bytes_sent "$http_referer" ' 
                      '"$http_user_agent" "$http_x_forwarded_for"'; 

    access_log /var/log/nginx/access.log main; 

    gzip              on; 
    sendfile          on; 
    keepalive_timeout 65; 
    server_names_hash_bucket_size 64; 

    server { 
      # this is a catch-all for requests with none of our hosts 

      listen 80 default; 
      location / { return 403; } 
    } 

    server { 
      server_name wordpress.yourdomainame.com; 

      location / { 
        proxy_set_header Host $host; 
        proxy_set_header X-Forwarded-For $remote_addr; 

        proxy_pass http://wordpress.freedom.box; 
      } 
    } 
}

Change the server_name setting to the domain name you used inside the WordPress module.
Restart nginx

/etc/init.d/nginx restart

Configure your router.

If you configure your router to forward port 80 to the internet module you can start blogging!

My FreedomBox architecture is built from isolated LXC modules, each having it’s own local IP address. A FreedomBox only has one internet address so there must be a component to route traffic from the internet to the various FreedomBox modules. This internet module is a vital part of the architecture.

On my FreedomBox I want the internet module to route traffic to the following services:

• Web-server modules. Example: A WordPress module.
• SSH servers. Some modules may support ssh access.
• E-Mail modules. SMTP / POP / IMAP and Webmail.
• Storage modules. I want to give family and friends some space on my FreedomBox for (encrypted) backups.

At the moment I have only implemented routing from the internet to web-server modules. The other routing functions of the internet module are still being researched. Building the internet module with web-server routing consists of the following steps:

• Create a LXC container to house the module.
• Instruct the DHCP server to give the container a static IP address.
• Start the container and continue installation.
• Install Nginx as reverse proxy.
• Adjust the router settings.

Read this first.

This article is one in a series that describes the building of my FreedomBox. Information from the previous articles like network and software configuration is not repeated.

Create the LXC internet container.

cd /var/lib/lxc
mkdir internet
/usr/lib/lxc/templates/lxc-debian-box -n internet -p /var/lib/lxc/internet

Give the internet container a static IP address.

edit /etc/dnsmasq.conf find the #commented line and replace with the next:

#dhcp-host=bert,192.168.0.70,infinite
dhcp-host=internet,192.168.1.10,infinite

NOTE: make sure that the address is within the specified dhcp-range setting.
Restart dnsmasq:

/etc/init.d/dnsmasq restart

Start the container and continue installation.

lxc-start -n internet -d

Login: (password = root)

ssh root@internet.freedom.box

Inside the container issue the following commands:

passwd
dpkg-reconfigure tzdata
dpkg-reconfigure locales
apt-get update
atp-get upgrade
ifconfig

Choose both a locale and default locale (my system: es_US.UTF-8).
The IP address that ifconfig reports should be the one specified in dnsmasq.conf.

Install Nginx as a reverse proxy.

Nginx has great features that makes it ideal to act as a reverse proxy (a proxy from the internet to the system) inside the internet module. It supports HTTP, SMTP, POP3, IMAP and uWSGI. These are all things that I want.

Unfortunately Debian only has a legacy version (0.7.67) in its repository. This version does not support the uwsgi protocol that is used by Python powered websites. The lack of Python support and the fact that version 0.7.67 is basically a two year old version that is bugfixed made me decide to compile the newest version (1.0.0).

Compiling is simple and painless:

apt-get install wget
apt-get install gcc
apt-get install make
apt-get install libpcre3 libpcre3-dev
apt-get install openssl libssl-dev

cd /usr/src

wget http://nginx.org/download/nginx-1.0.0.tar.gz
tar xfvz nginx-1.0.0.tar.gz

cd nginx-1.0.0

./configure \
  --conf-path=/etc/nginx/nginx.conf \
  --lock-path=/var/lock/nginx.lock \
  --error-log-path=/var/log/nginx/error.log \
  --http-log-path=/var/log/nginx/access.log \
  --pid-path=/var/run/nginx.pid \
  --http-client-body-temp-path=/var/run/nginx/client_body_temp \
  --http-proxy-temp-path=/var/run/nginx/proxy_temp \
  --http-fastcgi-temp-path=/var/run/nginx/fastcgi_temp \
  --http-uwsgi-temp-path=/var/run/nginx/uwsgi_temp \
  --http-scgi-temp-path=/var/run/nginx/scgi_temp \
  --with-mail \
  --with-mail_ssl_module \
  --with-http_ssl_module \
  --user=www-data \
  --group=www-data \
  --with-cc-opt="-DNGX_HAVE_ACCEPT4=0"

make
make install

mkdir -p /var/run/nginx/client_body_temp
mkdir -p /var/run/nginx/proxy_temp
mkdir -p /var/run/nginx/fastcgi_temp
mkdir -p /var/run/nginx/uwsgi_temp
mkdir -p /var/run/nginx/scgi_temp

These commands install Nginx in /usr/local/nginx/sbin. The only thing that’s missing now is an init.d script. I use the following (too simple?) script:

#! /bin/sh

### BEGIN INIT INFO
# Provides:          nginx
# Required-Start:    $local_fs $remote_fs $network $syslog
# Required-Stop:     $local_fs $remote_fs $network $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: starts the nginx web server
# Description:       starts nginx using start-stop-daemon
### END INIT INFO

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
DAEMON=/usr/local/nginx/sbin/nginx
NAME=nginx
DESC=nginx

# Include nginx defaults if available
if [ -f /etc/default/nginx ] ; then
    . /etc/default/nginx
fi

test -x $DAEMON || exit 0
set -e

. /lib/lsb/init-functions

case "$1" in
    start)
        echo -n "Starting $DESC: "
        $DAEMON
        echo "$NAME."
        ;;
    stop)
        echo -n "Stopping $DESC: "
        $DAEMON -s stop
        echo "$NAME."
        ;;
    restart|force-reload)
        echo -n "Restarting $DESC: "
        $DAEMON -s stop
        sleep 1
        $DAEMON
        echo "$NAME."
        ;;
    reload)
        echo -n "Reloading $DESC configuration: "
        $DAEMON -s reload
        echo "$NAME."
        ;;
    configtest)
        echo -n "Testing $DESC configuration: "
        $DAEMON -t
        ;;
    status)
        status_of_proc -p /var/run/$NAME.pid "$DAEMON" nginx && exit 0 || exit $?
        ;;
    *)
    echo "Usage: $NAME {start|stop|restart|reload|force-reload|status|configtest}" >&2
    exit 1
    ;;
esac
exit 0

Copy this code into a new file and save it as nginx in the directory: /etc/init.d
Check if everything works:

/etc/init.d/nginx start

If you browse to http://internet.freedom.box you should see the Nginx welcome message.
Make the script run at startup:

cd /etc/init.d
update-rc.d nginx defaults

Adjust the router settings.

The router can now forward requests to the internet module. This is not very interesting at the moment (you will only see the Nginx welcome message). In the next article I will build a WordPress module and connect this module to the internet module.