Before I retired, if I wanted access to the corporate systems, I would start up a tool (vpn/dialer) which set up an encrypted session to the corporate front end, and tunnel through this to get to the back end. It was transparent and was like being directly attached.
How do you set up your castle to allow authorised people in – but deny access to unauthorised access?
If you logon directly to a back-end server from a cafe or other public WiFi, your credentials etc may be in the clear. You need to use “a secure app” such as banking app, or provide a vpn or tunnel to access your system to encrypt the traffic.
I’ve been logging on to someone else’s system and most of the useful connections to this are disabled. I could access via 3270 but could not use FTP etc.
I was trying to debug a TLS problem and found suspicious evidence in the trace. A connection was being made to the TLS port on my server, and failing because it did not speak TLS. Someone had clearly found the IP address of my system, and was trying all ports to get in!
How do you protect the system and keep unwanted people out – but allow authorised people to connect. You need to do both of…
- Go through a secure tunnel which requires userid and password (or other identity checks) and, once inside, use the port.
- Use IPSEC to block the original port.
- Using this tunnel needs a little care.
Secure tunnelling
You could use TLS to protect the conversation between client and server, but this means you have allowed the connection to get through TCP/IP and to your application before checking to see if the connection is permitted.
Port forwarding or tunnelling controls access to your system at the outer edge of your system, logically within TCP/IP, before it gets to your application. It is well described here.
I used the SSH command
ssh -N -L 9876:12.23.34.45:8765 colin@23.34.45.56 -p 2222
If I used address https://localhost:9876 in my web browser, I am connected to 12.23.34.45:8765 through system 23.34.45.56 .
Where
- -N says port forwarding
- my local port 9876 is linked to 12.23.34.45 port 8765
- via IP address 23.34.45.56. Think of this as the guard house.
- colin is the userid. You get prompted for your password.
- use port 2222 at the guard house. Think of multiple entrances to the guard house. “General public” “special guest” “people who work here”. The port says go to the “special guest” door. The first time, you have to successfully logon with your userid and password to get your details recorded as a valid visitor to the site. You are given a token which is saved for next time you want access (think of it as a visitor badge).
What is IPSEC?
IPSEC is part of Communications Server on z/OS. It provides
- IP filtering to control which packets can enter the system
- IP filtering to control which packets can leave the system
You can filter on
- packet information – allow a ping, but not FTP
- network attributes – only allow from a list of IP address
- time – at certain times of day. For example a normal working day – so if someone is trying to access this system at two o’clock in the morning, this would be worth investigating.
You can
- allow
- deny
- log
You need to be careful setting the rules up – if you want to allow traffic in from 1.2.3.4, then you need to allow traffic out to address 1.2.3.4
My rule
I would set up an input rule like
For input port 8765 deny all access, all packet types, all hours of the day.
Using the tunnel needs a little care
The browser validates the certificate sent from the server. If there ALTNAME, the client(browser) should check that the IP address specified in the ALTNAME matches the IP address used in the original URL, and your connection has not been high jacked.
In my browser I used https://127.0.0.1:9876, where 9876 was specified in the ssl command above. The certificate at the server had ALTNAME with IP address of 127.0.0.1, and so this was considered valid. The IP ALTNAME IP adddress is usually the IP address of the server (or one of them if there are more than one) so you may get messages saying an insecure certificate is being used. You can accept this, or configure your browser to ignore these checks (which is not a good idea)
Thanks
Thanks to Lionel Dyck and Randy Rackov for their help in this blog post.
ColinPaice 