0

Let me explain the scenario that goes in our company.

We use VPN.

Then, we use Remote Desktop Connection RDP and connect to a server.

From that server, we access other remote application servers using SSH (just SSH, no tunneling). (Our job is that of linuxadmin)

Whereas to connect to the database, we require to create a SSH Tunnel to the database.

I asked my manager about it but he wasn't very clear about it either or probably I missed the point. I don't understand the point of SSH tunneling. And why's that not directly accessible? What difference does SSH Tunneling makes in security, because if I am not wrong, almost everyone with the application server's access under the same VPN, can access that database via SSH tunneling.

Is there any advantage that SSH Tunneling offers in this scenario?

I'm failing to see a problem that SSH tunneling is solving in this scenario.

Improve this question
3
  • 1
    Are you able to connect directly to the database using VPN? If you can't, that's the answer.
    – annahri
    Jul 9 at 15:30
  • No. But would not anyone with access to that application server(i.e people with vpn access) be able to tunnel?
    – zeeshanseikh
    Jul 9 at 16:27
  • Does it hinder you? If it does hinder you, you should explain how it would. Anyway, I guess this depends on the solution your company chose to track activity (to know who did what).
    – A.B
    Jul 9 at 17:23

2 Answers 2

Reset to default
1

From comments

Are you able to connect directly to the database using VPN? If you can't, that's the answer. – annahri

No. But would not anyone with access to that application server(i.e people with vpn access) be able to tunnel? – zeeshanseikh

Usually access to a VPN is not the same as as SSH access onto a [virtual] server. Even though you and your colleagues might have been given both, others might have been given only one or the other.

The answer might simply be a principle of minimising attack surfaces. The database may have been firewalled or otherwise configured so that only connections from the app server can access it. Likewise the app server might have had ssh access limited such that only VPN clients can access SSH.

In this case it sounds like the SSH tunnelling is a way for developers to negotiate their way through the network restrictions, they are not there themselves to add security. That is, the point is the restrictions not the tunnel.

Improve this answer
2
  • I just want to add. While everyone has a VPN access, it doesn't automatically mean everyone has the same SSH access. It might be restricted to certain VPN IP, user, groups, etc. My past company I worked on does this. Everyone is given VPN access but one can't go anywhere by default.
    – annahri
    Jul 9 at 23:02
  • @annahri yeah we do this too. We zone our VPN so having VPN access get's you a login but then you need specific authorisations for specific groups of subnets. IE devs don't get production access unless they really really need it.
    – Philip Couling
    Jul 10 at 12:09
0

You can use the firewall (iptables module owner) or network namespaces (interface invisible for others) for limiting who can use an SSH tun interface.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .