SSH/VNC for Remote Windows Access

Transcription

1 SSH/VNC for Remote Windows Access Eliminating the BASTION HOST in the SSH to Windows VNC connection. Joel Anderson OIT Security and Assuranace November 2002

2 Recently, we introduced the idea of remotely accessing a Windows system with SSH and VNC... Introducing the idea of using SSH protected VNC for a PC

3 Now there is a better way... Eliminate the BASTION put the SSH Server on the target host.

4 Advantages: reduces the number of machines to support closes the well known VNC ports (590x) eliminates the unencrypted traffic Disadvantages: Complexity ssh choices and manual setup (registry, passwd file) Physical security VNC machine must be physically secure (note, this is true for ANY use of VNC. When VNC is used, and a remote user is controlling a machine, the keyboard on the VNCSERVER is live and all actions are visible on the screen.)

5 Two steps to SSH+VNC 1) Install SSH on Windows system <--OpenSSH from CYGWIN <--complete CYGWIN environment 2) Install RealVNC, with loopback ONLY option As before VNC client uses SSH with forwarding to VNC server Change: Forwarding of VNC directly to target system. Target system only accepts local calls to VNC

6 To take advantage of securing VNC with SSH, you need to ADD SSH to a PC. There are two related packages you can use to add SSHD to a Windows system: cygwin more up-to-date, more features networksimplicity cygwin package simple install, fewer features

7 redhat.com/.com/cygwincygwin cygwin.com The Cygwin environment offers a Unix-like environment for a PC. It can give you a port of OpenSSH, it also can give a full development environment, i.e. You don't have to wait for ports of tools. You also have more tty support, and more tools when you connect into the machine.

8 networksimplicity.com NetworkSimplicity offers an OpenSSH package based on Cygwin. Includes just enough of the cygwin libraries and tools to run the Cygwin OpenSSH port. Installs easily on most Windows.

9 Here a miracle occurs... (skipping over the setup details; documented in Cygwin and NetworkSimplicity packages.) Once SSH is installed, You have the ability to log in, remotely to a PC. (this might meet all your needs without VNC)

10 Now you need the new version of VNC, REALVNC: New, improved realvnc has an option to do loopback only. This is important it means that you can run the VNC Server ON your PC, without opening a well known, possibly vulnerable port to the outside world... the only catch is...

11 You have to EDIT THE REGISTRY!!!!! but... not much.

12 You only have to use REGEDIT to add the DWORD entry LoopbackOnly set to 1:

13 Locking Down VNC Setting this entry will make the VNCSERVER software ONLY accept connections FROM itself. LoopbackOnly By default, WinVNC servers accept incoming connections on any network adapter address, since this is the easiest way of coping with multihomed machines. In some cases, it is preferable to listen only for connections originating from the local machine and aimed at the "localhost" adapter - a particular example is the use of VNC over SSH to provide secure VNC. Setting this registry entry to 1 will cause WinVNC to only accept local connections - this overrides the AllowLoopback and AuthHosts settings. Setting this entry to zero causes WinVNC to accept connections on any adapter and is the default setting.local machinespecific setting.

14 Installed as services, choose how you want the service to run manual you'll have to explicitly start the system when (can't accidently leave system available). automatic always starts (you won't get home and find out the the system isn't available).

15 Set password Useful to choose which screen you'll connect to display = the port you'll need to forward.

16 Now the SSH forwarding is localhost to localhost: Screen 3 for VNC is forwarded to the ssh host.

17 First Establish SSH session to target machine THEN, connect to LOCAL forwarded port Remember, the VNC Viewer is being aimed at a port on your local machine. The SSH session is forwarding that to the target (SSH server's machine, where the VNC SERVER is).

18 Two steps to SSH+VNC 1) Install SSH on Windows system <--OpenSSH from CYGWIN <--complete CYGWIN environment 2) Install RealVNC, with loopback ONLY option As before VNC client uses SSH with forwarding to VNC server Change: Forwarding of VNC directly to target system. Target system only accepts local calls to VNC

19 Remember when it comes to remote access... there is usually more than one way to do it......and some ways are safer than others.