socat TCP-LISTEN:22,fork TCP:192.168.0.15:5900
How can I tell to
socat, that port 22 is only trusted from the remote IP address 220.127.116.11, and it should not accept connections from other IP addresses? This is on a Linux server.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
You can add the
range option to the socat listening address:
socat TCP-LISTEN:22,fork,range=18.104.22.168/32 TCP:192.168.0.15:5900
Or you can add the
tcpwrap=vnc_forward option and define global rules for that
vnc_forward service as per hosts_access(5).
That won't stop the connections from reaching
socat will ignore them (with a warning) if they don't come from 22.214.171.124.
Most people use firewalls for that. Have a look at
iptables to restrict traffic to port 22 i.e.:
iptables -I INPUT -p tcp '!' -s 126.96.36.199 --dport 22 -j REJECT
Or, if the firewall is already restrictive, allow just one address:
iptables -A INPUT -p tcp -s 188.8.131.52 --dport 22 -j ACCEPT
Please note that this is not a full configuration for an iptables firewall, you first need to setup a proper configuration before using the above.
If your primary goal is security and you control the client machine then connecting to your socat server through an SSL tunnel is a safer bet, making the server verify the client cert before accepting connections.
I went through this recently trying to secure a synergy client/server setup.
This tutorial explains the setup clearly
One deviation from the instructions that I found is your client SSL library should reject the server key by default due to the patch for logjam
Appending the following to the server PEM makes everything work
openssl dhparam 2048 >> "$FILENAME".pem
This key based exchange mechanism is much more authoritative when it comes to validating hosts over IP based auth.