A user requires shell access to an Ubuntu server from the WAN side. There are many shell accounts with simple passwords. So shell port (port 22) is blocked in the firewall. For my WAN side user I am planning to run a ssh server in a Debian chroot, and open its port in the firewall. If this kind of setup is feasible, what is the best way of achieving it?
Single ssh server
If the only reason you're planning to run an SSH server in a chroot is to restrict password authentication to some users, you don't need that: you can tell sshd to allow passwords only for a whitelist of users. In
/etc/ssh/sshd_config, use a
PasswordAuthentication No Match User trusted_user_1,trusted_user_2 PasswordAuthentication yes
If you do want to chroot some users, you can still run a single ssh daemon, and use a
ChrootDirectory directive in
sshd_config (within the scope of a
Two ssh servers, listening on different addresses
You can have two ssh daemons listening on the same port, if they're listening on different addresses. Put a
ListenAddress directive in each
/etc/ssh/sshd_config, each with the IP address(es) you want that server to listen on (listen on, not listen to, i.e. these are addresses of your server's network interfaces). This is of limited applicability, only if your server machine is the node doing the LAN/WAN filtering. It also means that things like
ssh localhost won't be transparent (you can still access the daemon that's not listening on localhost with
Two ssh servers, listening on different ports
You can make the ssh daemon in the chroot listen on a different port, with the
Port directive in
/etc/ssh/sshd_config. Keep blocking port 22 from outside on your firewall and don't block the other port you selected for the chroot sshd.
Two ssh servers, routing performed by the firewall
If you have two daemons listening on different ports (as above), you can still give the illusion that they're both listening on port 22. For example make the chrooted ssh daemon listen on port 2201, and redirect traffic coming on port 22 on
eth1 to port 2201:
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 22 -j REDIRECT --to-ports 2201
Then ssh connections from localhost or over eth0 to port 22 will reach the non-chrooted server, while ssh connections over eth1 to port 22 will reach the chrooted server. Connections on port 2201 will reach the chrooted server. You can use other criteria than
-i eth, for example
! -s 10.1.0.0/16 ! -s 127.0.0.0/8 to match everything with a source address other than 10.1.x.y or loopback.