Skip to content

Lab6.1PortForwarding

Jump to bottom
Beth edited this page Mar 24, 2025 · 4 revisions

Delete static configurations with: ip route delete [destination] via [next gateway]

Set the following on fw01

image

I then decided to use log01 as my jump box, and logged into it to turn of rsyslog

SSH Weirdness

Start by creating a new passwordless user called [name]-jump

  • adduser [name]

Then make a key, I did this similar to how I generated keys for log01 before

ssh-keygen -t rsa - generate a key

  • Make sure to name it something different, I named mine "jumpkey"

Copy the public key to jump:

I ssh-ed to rw01 from mgmt01, cat-ed the public key on rw01, and then ssh-ed to jump from mgmt01. I ssh-ed to my named sudo user, switched to the passwordless user, created the .ssh folder by ssh-ing to a random host, and added the authorized_keys file with the contents of rw01's public key (copied from the other terminal that is connected to rw01)

Permissions for each of the files need to look like this:

image

  • sudo chown -R echadbourne:echadbourne jumpkey
  • sudo chown -R echadbourne:echadbourne jumpkey.pub

image

  • sudo chmod 700 /home/echadbourne-jump/.ssh
  • sudo chmod 600 /home/echadbourne-jump/.ssh/authorized_keys
  • sudo chown -R echadbourne-jump:echadbourne-jump /home/echadbourne-jump/.ssh

Go to /etc/ssh/sshd_config and uncomment "PubkeyAuthentication yes"

Restart sshd after all changes to be safe

Big thanks to Connor East for helping with the ssh part, this was a nightmare

Firewall Things (Port Forwarding)

I then needed to create a firewall rule to allow port 22 and inbound NAT on the firewall, this is what that looked like:

image

And a rule in the WAN-to-DMZ firewall to allow ssh

image

Wazuh

Start by creating the command for the agent installation via the dashboard, then I used curl to get the package on mgmt01 (aka the first half of the command)

Once I had the package, I used scp to get it to jump (in order to get the package in the right place I had to use the root user)

  • scp [wazuh agent package] root@172.16.50.4:/home/echadbourne

And from there I could use my privileged user to run the second have of the command to install the package.

I then created and started the daemon

  • sudo systemctl daemon-reload
  • sudo systemctl enable wazuh-agent
  • sudo systemctl start wazuh-agent

Netplan

Netplan resources can be found here:

Here is some more examples:

Reflection

This lab was difficult for me because of all of the ssh weirdness (hence the name) that just continued to give me trouble. Once I figured out how to get the public key to jump (through the use of copy-pasting on mgmt01) I ran into more problems with permissions not being clear (what needed to be owned/read/write whatever) as well as a configuration that I missed that I needed to change. Overall it was very frustrating, so big shout out to Connor for helping sort out my permissions and get it working.

I also ran in to issues with files or directories "not existing," I'm still not sure what that was about but I managed to work around it I guess.

Extra sources:

https://www.digitalocean.com/community/tutorials/how-to-set-up-ssh-keys-on-centos7

https://docs.vyos.io/en/latest/configuration/nat/nat44.html

https://github.com/ConnorEast/Tech-Journal/wiki/Lab-6.1-Port-Forwarding-and-Jump-Boxes

Connor used this to help me

https://www.howtogeek.com/804179/scp-command-linux/

Clone this wiki locally