Stunnel/Scp - Revision history

Admin at 05:17, 5 April 2017

2017-04-05T05:17:44Z

← Older revision		Revision as of 05:17, 5 April 2017
Line 78:		Line 78:

	[[Category:SSH]]		[[Category:SSH]]

			[[Category:Stunnel.conf]]

Admin: /* Flags */

2017-03-31T03:09:49Z

Flags

← Older revision		Revision as of 03:09, 31 March 2017
Line 77:		Line 77:
	{{StunnelFlag}}		{{StunnelFlag}}

	[[~~Caegory~~:~~Scp~~]]		[[Category:SSH]]

Admin: /* Testing scp over stunnel */

2017-03-31T03:09:35Z

Testing scp over stunnel

← Older revision		Revision as of 03:09, 31 March 2017
Line 69:		Line 69:

	Note that if passwordless access has been set up between the remote and client machines, this will NOT ask the user for their password - excellent for exfiltrating data from a [[RaspberryPi]] to a command-and-control server.		Note that if passwordless access has been set up between the remote and client machines, this will NOT ask the user for their password - excellent for exfiltrating data from a [[RaspberryPi]] to a command-and-control server.




			=Flags=

			{{StunnelFlag}}

			[[Caegory:Scp]]

Admin: /* Testing scp over stunnel */

2017-03-31T03:09:16Z

Testing scp over stunnel

← Older revision		Revision as of 03:09, 31 March 2017
Line 65:		Line 65:
	[client] $ scp -P 2222 secrets.file zappa@remote:~/.		[client] $ scp -P 2222 secrets.file zappa@remote:~/.
	secret.file 100% 22 0.3KB/s 00:00		secret.file 100% 22 0.3KB/s 00:00
			[client] $
	</pre>		</pre>

	Note that if passwordless access has been set up between the remote and client machines, this will NOT ask the user for their password - excellent for exfiltrating data from a [[RaspberryPi]] to a command-and-control server.		Note that if passwordless access has been set up between the remote and client machines, this will NOT ask the user for their password - excellent for exfiltrating data from a [[RaspberryPi]] to a command-and-control server.

Admin: /* Testing scp over stunnel */

2017-03-31T03:09:03Z

Testing scp over stunnel

← Older revision		Revision as of 03:09, 31 March 2017
Line 64:		Line 64:
	[client] $ echo "Secret stuff!" > secrets.file		[client] $ echo "Secret stuff!" > secrets.file
	[client] $ scp -P 2222 secrets.file zappa@remote:~/.		[client] $ scp -P 2222 secrets.file zappa@remote:~/.
			secret.file 100% 22 0.3KB/s 00:00
	</pre>		</pre>

	Note that if passwordless access has been set up between the remote and client machines, this will NOT ask the user for their password - excellent for exfiltrating data from a [[RaspberryPi]] to a command-and-control server.		Note that if passwordless access has been set up between the remote and client machines, this will NOT ask the user for their password - excellent for exfiltrating data from a [[RaspberryPi]] to a command-and-control server.

Admin: /* Setting up server */

2017-03-31T03:08:52Z

Setting up server

← Older revision		Revision as of 03:08, 31 March 2017
Line 53:		Line 53:

	Now the stunnel server will be listening on port 443. Traffic received will be decrypted and sent along to port 22.		Now the stunnel server will be listening on port 443. Traffic received will be decrypted and sent along to port 22.


			==Testing scp over stunnel==

			Now we can test out scp over stunnel to make sure it works:

			These two commands will create a dummy file and secure-copy it to zappa's user directory on the remote machine:

			<pre>
			[client] $ echo "Secret stuff!" > secrets.file
			[client] $ scp -P 2222 secrets.file zappa@remote:~/.
			</pre>

			Note that if passwordless access has been set up between the remote and client machines, this will NOT ask the user for their password - excellent for exfiltrating data from a [[RaspberryPi]] to a command-and-control server.

Admin: /* Setting up server */

2017-03-31T03:06:52Z

Setting up server

← Older revision		Revision as of 03:06, 31 March 2017
Line 51:		Line 51:
	connect = 127.0.0.1:22		connect = 127.0.0.1:22
	</pre>		</pre>

			Now the stunnel server will be listening on port 443. Traffic received will be decrypted and sent along to port 22.

Admin: /* Setting up client */

2017-03-31T03:06:14Z

Setting up client

← Older revision		Revision as of 03:06, 31 March 2017
Line 4:		Line 4:

	==Setting up client==		==Setting up client==

			To set up the client, use an identical config script to [[Stunnel/SSH]], except change the protocol from <code>[ssh]</code> to <code>[scp]</code>:

	<pre>		<pre>
Line 20:		Line 22:
	connect = 96.126.102.36:443		connect = 96.126.102.36:443
	</pre>		</pre>

			Now scp commands can be directed through port 2222 using CAPITAL P:

			<pre>
			$ scp -P 2222 <...>
			</pre>

			This will redirect the scp traffic to port 443, through stunnel, and on to port 22 on the remote server.

	==Setting up server==		==Setting up server==

Admin: /* Setting up client */

2017-03-31T03:04:54Z

Setting up client

← Older revision		Revision as of 03:04, 31 March 2017
Line 4:		Line 4:

	==Setting up client==		==Setting up client==

			<pre>
			# client config,
			# will ssh directly to local port 2222
			# ssh -p 2222 root@localhost
			# stunnel client connects to remote stunnel server at IP A.B.C.D over external port 443

			output = /var/log/stunnel4/stunnel.log
			cert = /usr/local/etc/stunnel/stunnel.fullchain.pem
			key = /usr/local/etc/stunnel/stunnel.key.pem
			pid = /var/run/stunnel4/stunnel.pid
			client = yes
			[scp]
			accept = 2222
			connect = 96.126.102.36:443
			</pre>

	==Setting up server==		==Setting up server==

Admin: Created page with "This page covers a basic configuration for getting secure copy (SCP) working over an stunnel connection. =Overview= ==Setting up client== ==Setting up server== We want the..."

2017-03-31T03:00:51Z

Created page with "This page covers a basic configuration for getting secure copy (SCP) working over an stunnel connection. =Overview= ==Setting up client== ==Setting up server== We want the..."

New page

This page covers a basic configuration for getting secure copy (SCP) working over an stunnel connection.

=Overview=

==Setting up client==

==Setting up server==

We want the stunnel server to listen over 443, and forward traffic to port 22 (scp uses same port as SSH).

Only thing different from [[Stunnel/SSH]] server config file is the protocol name:

<pre>
# server config,
# stunnel server will listen for stunnel clients connecting on port 443
# traffic will be decrypted and forwarded to local port 22

output = /var/log/stunnel4/stunnel.log
cert = /etc/stunnel/stunnel.fullchain.pem
key = /etc/stunnel/stunnel.key.pem
pid = /var/run/stunnel4/stunnel.pid
client = no
[scp]
accept = 443
connect = 127.0.0.1:22
</pre>