Autossh plugin for OPNsense #818

ndejong · 2018-09-05T07:45:14Z

This PR implements a UI for the autossh package thus providing the ability to create and persist SSH tunnels from the OPNsense system to remote systems.

Features

Default ssh-key permissions that prevent unwanted remote ssh-server shell access abuses.
Ability to define local-forward and remote-forward TCP tunnels.
Ability to define local network SOCKS proxy via a remote host (aka dynamic-forward).
Ability to bind outbound ssh connections to different (external) interfaces.
Ability to configure many (27x) of the ssh-client connection parameters, including all cryptographic options.
Ability to observe the health status of the tunnel at a glance.
Can rely on Autossh to reestablish a tunnel after a connectivity outage.

Various use cases

Provide remote network access to a site that has no public addresses, such as when ISPs use NAT.
Ensure redundant multipath remote access via primary and secondary connections via interface binding.
Create your own "privacy" VPN system for all local network users using a SOCKS proxy (dynamic-forward) to a remote system.
Provide local network access to remote system services such as a SMTP relay or another SSH service.
Provide remote system access to a local network services such as a database or RDP service.
Provide access remote system access to other remote network acting as a middle-man TCP-port connector.

Looking forward to feedback

fabianfrz

Some stuff tried to not repeat myself

fabianfrz · 2018-09-05T15:17:51Z

net/autossh/src/opnsense/mvc/app/controllers/VerbNetworks/Autossh/Api/ServiceController.php

+            $response = array("status"=>"success", "data" => $model->isConfigChange(), "message"=>null);
+        }
+
+        return $response;


The $response variable is not needed

Returning early has been applied in all controllers - it's an old habit

fabianfrz · 2018-09-05T15:19:21Z

net/autossh/src/opnsense/mvc/app/controllers/VerbNetworks/Autossh/Api/ServiceController.php

+
+    public function startAction()
+    {
+        $response = array('status'=>'fail', 'message' => 'Invalid request');


Use the same spacing style

fabianfrz · 2018-09-05T15:26:52Z

net/autossh/src/opnsense/mvc/app/controllers/VerbNetworks/Autossh/Api/ServiceController.php

+                    'local' => htmlspecialchars($tunnel['local_forward']),
+                    'dynamic' => htmlspecialchars($tunnel['dynamic_forward']),
+                    'remote' => htmlspecialchars($tunnel['remote_forward']),
+                    'tunnel' => htmlspecialchars($tunnel['tunnel_device'])


This is an api, not a html renderer. No escaping here. Especially because of this ugly hack:
opnsense/core#2672

Escaping must be done in the viewer - which is the js code of the frontend.

Yes, I'm aware of opnsense/core#2672 if you take a look at my TunnelsController I specifically have an afterExecuteRoute() function to be able to step outside it in a very limited case - even with me implementing this I guess it did not occur to me that using htmlspecialchars() here is in-fact double-escaping things - either way, resolved

fabianfrz · 2018-09-05T15:27:15Z

net/autossh/src/opnsense/mvc/app/controllers/VerbNetworks/Autossh/Api/ServiceController.php

+
+                $response['rows'][] = array(
+                    'uuid' => $tunnel['uuid'],
+                    'connection' => htmlspecialchars($connection),


fabianfrz · 2018-09-05T15:30:41Z

net/autossh/src/opnsense/mvc/app/controllers/VerbNetworks/Autossh/forms/tunnels.xml

+        <id>tunnel.description</id>
+        <label>Description</label>
+        <type>text</type>
+        <help><![CDATA[Free form text field available to describe this connection if required.]]></help>


No cdata needed

okay - CDATA removed from the fields where it is not needed

fabianfrz · 2018-09-05T15:32:32Z

net/autossh/src/opnsense/mvc/app/models/VerbNetworks/Autossh/Autossh.php

+    public function setConfigChangeOn()
+    {
+        touch($this->config_status_filename);
+        return true;


Instead you can just return nothing

fabianfrz · 2018-09-05T15:33:51Z

net/autossh/src/opnsense/mvc/app/views/VerbNetworks/Autossh/settings.volt

+            <div  class="col-md-12">
+                <h1>Autossh</h1>
+                <p>
+                    The Autossh plugin for OPNsense is a tool for establishing, maintaining and managing 


Needs translation.

fabianfrz · 2018-09-05T15:37:01Z

net/autossh/src/opnsense/mvc/app/views/VerbNetworks/Autossh/settings.volt

+                        },
+                        code_wrap: function(column, row) {
+                            if(row[column.id].length > 0) {
+                                return '<code>' + row[column.id] + '</code>';


This is one of the places, where you would have to escape if this issue would not exist.

This is an excellent catch

fabianfrz · 2018-09-05T15:44:15Z

net/autossh/src/www/diag_logs_autossh.php

+
+$logfile = '/var/log/autossh.log';
+$logclog = true;
+// $service_hook = 'autossh';


Delete dead code

ndejong · 2018-09-06T01:32:22Z

@fabianfrz super appreciate the rapid turn around on feedback here, it really impresses me about the OPNsense team - I'm going to be busy on another project for the next week and will not be able to address these in the same quick turn around

mimugmail

Some small things. I like the idea of autossh. Normally I'd do this with OpenVPN but SSH as an alternative is also nice

mimugmail · 2018-09-06T05:21:46Z

net/autossh/Makefile

+PLUGIN_COMMENT=     Create and automatically persist SSH based tunnels.
+PLUGIN_MAINTAINER=  contact@verbnetworks.com
+PLUGIN_WWW=         https://verbnetworks.com
+PLUGIN_DEVEL=       no


mimugmail · 2018-09-06T05:23:11Z

net/autossh/src/etc/rc.d/autossh

@@ -0,0 +1,182 @@
+#!/bin/sh


Normally whene there's no init script it's called opnsense-xxx so there wont be a collision when a new script comes in future by pkg maintainer

Ahh - I recall wondering about this - thanks, and sorting it out now

Also dont forget in rc.conf.d .. 👍

mimugmail · 2018-09-06T05:24:48Z

net/autossh/src/opnsense/mvc/app/controllers/VerbNetworks/Autossh/Api/KeysController.php

+
+    public function infoAction($uuid = null)
+    {
+        $ssh_key_restrictions = 'command="",no-agent-forwarding,no-pty,no-user-rc,no-X11-forwarding';


This is listed in the volt, no idea if this is really necessary?

yes - displaying the ssh public key to the user in a manner that is designed to prevent other security accidents is a deliberate thing as there will be some that may not understand the potential flow on effects - anyone that wants to strip off the key restrictions ought to know what they are doing

Ok, looked a bit strange in UI bit I didn't have a deeper look into it yet.

mimugmail · 2018-09-06T05:26:54Z

net/autossh/src/opnsense/mvc/app/controllers/VerbNetworks/Autossh/forms/keys.xml

+        <id>key.type</id>
+        <label>Type</label>
+        <type>dropdown</type>
+        <help>Select the type of SSH key to be generated - can't be modified after the key has been generated.</help>


mimugmail · 2018-09-06T05:27:37Z

net/autossh/src/opnsense/mvc/app/controllers/VerbNetworks/Autossh/forms/keys.xml

+        <id>key.description</id>
+        <label>Description</label>
+        <type>text</type>
+        <help>Free form input to describe this sshkey (not parsed).</help>


Here sshkey, below SSH key ..

mimugmail · 2018-09-06T05:28:29Z

net/autossh/src/opnsense/mvc/app/controllers/VerbNetworks/Autossh/forms/tunnels.xml

+        <id>tunnel.user</id>
+        <label>User</label>
+        <type>text</type>
+        <help><![CDATA[Provide the connection username for this connection.]]></help>


I'd remove the first connection

Sharp eyes 👍

mimugmail · 2018-09-06T05:35:36Z

net/autossh/src/opnsense/mvc/app/models/VerbNetworks/Autossh/Autossh.xml

+                    </optionvalues>
+                </macs>
+
+                <port type="IntegerField">


You could also use PortField, no validation or min/max required

Ahh cool - I did not know

mimugmail · 2018-09-06T05:38:21Z

net/autossh/src/opnsense/mvc/app/views/VerbNetworks/Autossh/settings.volt

+
+<div class="alert alert-info hidden" role="alert" id="responseMsg"></div>
+<div class="alert alert-info hidden" role="alert" id="applyChangesMessage">
+   <button class="btn btn-primary pull-right" id="btnApplyChanges" type="button"><b>{{ lang._('Apply changes') }}</b> <i id="btnApplyChangesProgress"></i></button>


This reminds me of legacy code how to apply changes, searched some time after I found the button :)

I took this approach because I could not see a better way to handle it

The underlying thing driving this is the need to call a helper script to correctly render the required ssh_config files because as best as I can tell I am not able to get what I need with Jinja alone - go looking for AutosshConfigHelper.py if you are interested

mimugmail · 2018-09-06T08:05:32Z

Found this in system.log:

Sep  6 10:00:11 OPNsense /usr/local/bin/ssh[32527]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:00:11 OPNsense /usr/local/bin/ssh[32626]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:00:11 OPNsense /usr/local/bin/ssh[32684]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:00:12 OPNsense /usr/local/bin/ssh[32826]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:00:15 OPNsense /usr/local/bin/ssh[32956]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:00:20 OPNsense /usr/local/bin/ssh[33204]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:00:27 OPNsense /usr/local/bin/ssh[33458]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:00:36 OPNsense /usr/local/bin/ssh[46289]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:00:48 OPNsense /usr/local/bin/ssh[46474]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:01:05 OPNsense /usr/local/bin/ssh[48934]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:01:13 OPNsense /usr/local/bin/ssh[50763]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:01:13 OPNsense /usr/local/bin/ssh[50821]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:01:13 OPNsense /usr/local/bin/ssh[50925]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:01:13 OPNsense /usr/local/bin/ssh[51050]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:01:13 OPNsense /usr/local/bin/ssh[51240]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:01:13 OPNsense /usr/local/bin/ssh[51255]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:01:13 OPNsense /usr/local/bin/ssh[51313]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:01:13 OPNsense /usr/local/bin/ssh[51635]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.
Sep  6 10:01:14 OPNsense /usr/local/bin/ssh[51858]: fatal: /usr/local/etc/autossh/autossh.conf line 18: Bad SSH2 cipher spec 'ciphers_01,ciphers_02,ciphers_03,ciphers_04,ciphers_05,ciphers_06'.

ndejong · 2018-09-11T07:25:07Z

These log messages are because you have managed to get yourself into a condition where the ssh_config file has not been rendered, your posting has made me notice an edge case that I have two approaches to resolve - pending

ndejong · 2018-09-11T07:40:47Z

Also - another thing here, it's is not clear to me how to "catch" these particular /usr/local/bin/ssh syslog messages to have them appear as Autossh Log messages - nothing I've tried adding in plugins.inc.d/autossh.inc seems to have the effect I'm looking for

fichtner

Hi @ndejong,

I apologise for the delay. Here are preliminary comments for eventual inclusion:

The plugin is pretty big which makes initial review difficult. Next step for me would be to use it in action to get a feel for the whole thing.
Kind of split on the OPNsense vs. vendor namespace as initially suggested. Ideally different vendors should be reserved for other projects, commercial and custom plugins. It doesn't matter that much, but it would be nicer to have a single "open source upstream" namespace. What do you think?
rc.d script is quite complex and may be nice to have in FreeBSD per default.

Cheers,
Franco

fichtner · 2018-11-13T18:41:58Z

net/autossh/src/etc/rc.d/opnsense-autossh

+. /etc/rc.subr
+
+name=autossh
+rcvar=${name}_enable


this will eventually clash with freebsd when an rc.d script is added in the package: rename var or maybe add a FreeBSD rc.d script?

fichtner · 2018-11-13T18:44:04Z

net/autossh/LICENSE

@@ -0,0 +1,24 @@
+Copyright (c) 2018 Verb Networks Pty Ltd <contact@verbnetworks.com>


This file is implicit from the code lines. and will be in the main LICENSE file merged with all other contributors, but I don't have issues pulling this in. :)

fichtner · 2018-11-13T18:45:14Z

net/autossh/README.md

@@ -0,0 +1,30 @@
+# Autossh


makes more sense to move this to pkg-descr -- we use the FreeBSD description for general direction, but if you have more to say about your plugin that is the spot since you can read it from the GUI.

fichtner · 2018-11-13T18:48:51Z

net/autossh/src/opnsense/mvc/app/models/VerbNetworks/Autossh/Menu/Menu.xml

+<menu>
+    <VPN>
+        <Autossh VisibleName="Autossh" cssClass="fa fa-chain fa-fw">
+            <AutosshTunnels VisibleName="Tunnel Settings" url="/ui/autossh/settings" order="10"/>


mostly opting for easier node names for sorting in larger menus, but so not relevant here. just a comment.

kosli · 2020-06-22T13:55:48Z

@ndejong @fabianfrz is there an update on this pull-request so that it might get integrated into the distributed plugins?

fabianfrz · 2020-06-22T20:04:06Z

@fichtner I think the question is more for you.

ndejong · 2020-06-25T03:42:51Z

More than happy to jump in and give life to this. The biggest bump-in-the-road was the namespacing which in 2018 was not super-clear, I went down the wrong garden path which deflated some of the enthusiasm at the time - all good, if there is an interest pretty easy to fix.

The things that probably stand out at the moment are -

catching the last feedback items from @fichtner dated 14th November 2018
refactoring for Python3
adjusting the namespace to suit OPNsense

As it happens, I've recently started a new fork on the configsync-plugin to address the Python3 and namespace concerns and I'm more likely to get that one out first.

fichtner · 2021-10-21T12:03:00Z

This hasn't been moving since 2018 so after internal discussion this can no longer be included in the current form. Also we are still concerned about sizeable first-time contributions as our community review time is not unlimited.

Cheers,
Franco

ndejong · 2021-10-23T03:41:49Z

Fair enough, no one could fault the OPNsense team on this @fichtner @fabianfrz

For my part, I wrote both #818 (Autossh plugin) and #777 (Configuration Sync) at a time when I had a few months spare time and was interested in supporting anything that was not the "other" pf based firewall distribution.

Having pained through the efforts of writing FauxAPI for that other distribution it was awesome to discover OPNsense had managed to introduce an MVC framework which made it much easier to write these two substantial plugins - finally some development sanity!

I have another OPNsense plugin in the long-slow cooker around Slack Nebula but I kinda expect someone else might be able to get that to happen before me - perhaps others are already working on this?

If I do find time to bring these to life again it'll be a new pull-request via my personal @ndejong Github.

Regards,
N

initial commit of the Autossh plugin

2ee4064

fabianfrz reviewed Sep 5, 2018

View reviewed changes

mimugmail reviewed Sep 6, 2018

View reviewed changes

Addresses first round of feedback from OPNsense team

a040131

fichtner self-assigned this Nov 13, 2018

fichtner reviewed Nov 13, 2018

View reviewed changes

fichtner mentioned this pull request Nov 13, 2018

Configuration Sync - Initial commit into the OPNsense-plugins repo #777

Closed

fichtner closed this Oct 21, 2021

		@@ -0,0 +1,24 @@
		Copyright (c) 2018 Verb Networks Pty Ltd <contact@verbnetworks.com>

Autossh plugin for OPNsense #818

Autossh plugin for OPNsense #818

Conversation

ndejong commented Sep 5, 2018

fabianfrz left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ndejong commented Sep 6, 2018

mimugmail left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mimugmail commented Sep 6, 2018

ndejong commented Sep 11, 2018

ndejong commented Sep 11, 2018

fichtner left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kosli commented Jun 22, 2020

fabianfrz commented Jun 22, 2020

ndejong commented Jun 25, 2020

fichtner commented Oct 21, 2021

ndejong commented Oct 23, 2021