Lab 6.1: Port Forwarding and Jump Boxes - squatchulator/Tech-Journal GitHub Wiki

Lab 6.1 - Port Forwarding & Jump Boxes

Reflection

In this lab I really struggled getting passwordless SSH working. The fact that the passwordless account did not have a password seemed to make SSH bug out, and no matter how many different guides I followed I could not get it working - it would keep asking for a password. Finally, I just decided to do the SSH key transfers using the standard user account that did have a password, and after I did this it immediately started working without even asking for the password. I am really not sure why this was the case, but I was relieved to have it working in some regard. I feel like I got a better idea of how key transfers work and how the SSH authentication system works.

Remove your static route from Rw01

  • This can be checked with ip route. Remember, the route we added was something like 172.16.50.0/29 via 10.0.17.114.
  • Remove it with sudo ip route delete 172.16.50.0/29

Port Forwarding

  • Now that we've removed the static route, we need to set up port forwarding so that port 80 traffic coming to the firewall is directed to Web01.
set nat destination rule 10 destination port 80
set nat destination rule 10 inbound-interface eth0
set nat destination rule 10 protocol tcp
set nat destination rule 10 translation address 172.16.50.3
set nat destination rule 10 translation port 80
set nat destination rule 10 description HTTP->WEB01
commit
save
  • You should be able to curl your webserver from Rw01 at this point. If not, go into the manual network settings and reconfigure your IP assignment, making sure that there are no static routes confuigured.

The Jump Box

  • Set a hostname, IP address, change champuser password, and manually change the VCenter network to the DMZ network.
    • hostnamectl hostname jump-yourname
    • passwd champuser
    • sudo nano /etc/netplan/00-installer-config.yaml
network:
  ethernets:
    ens160:
      addresses: [172.16.50.4/29]
      gateway4: 172.16.50.2
      nameservers:
        addresses: [172.16.50.2]
  version: 2
  • Now, run sudo netplan apply

Firewalls & SSH

  • Now we need to adjust the firewall rules from LAN-to-DMZ so that mgmt01 can ssh into any DMZ server.
set firewall name LAN-to-DMZ rule 20 description 'ssh from mgmt01 to DMZ'
set firewall name LAN-to-DMZ rule 20 destination address '172.16.50.0/29'
set firewall name LAN-to-DMZ rule 20 destination port '22'
set firewall name LAN-to-DMZ rule 20 protocol 'tcp'
set firewall name LAN-to-DMZ rule 20 source address '172.16.150.10'

Key Generation on Rw01

Create the jump user

sudo useradd -mk /etc/skel -s /bin/bash -d /home/miles-jump miles-jump
cd /home/miles-jump
mkdir .ssh

On Rw01:

  • Generate a key pair in the .ssh folder using ssh-keygen. Ensure you create a password, and change the name to something like yourname-jump.

On Rw01:

mkdir keys
cd keys
ssh-keygen -t rsa -b 4096 (name it <username>-jump)

On Mgmt01:

  • Create a FTP instance to make this server act as an intermediate for file transfer.
sftp <username>@<ip of rw01>:/home/<username>/.ssh/<username>-jump.pub
scp ~/.ssh/<username>-jump.pub <username>@<jump ip>:

On Jump:

cd ..
sudo chown <user> <username>-jump
cd <username>-jump
mkdir .ssh && cat <username>-jump.pub >> .ssh/authorized_keys
sudo chown <username>-jump .ssh && sudo chown <username>-jump .ssh/authorized_keys
sudo cp <username>-jump.pub /home/<username>-jump/
sudo su <username>-jump

On Rw01:

cp ~/keys/<username>-jump ~/.ssh

Wazuh Agent on Jump

  • First download the agent file from Wazuh via mgmt01.
sudo apt-get install curl -y
mkdir tmp
cd tmp
curl -so wazuh-agent-4.3.11.deb https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.3.11-1_amd64.deb && sudo WAZUH_MANAGER='172.16.200.10' WAZUH_AGENT_GROUP='linux' dpkg -i ./wazuh-agent-4.3.11.deb
scp wazuh-agent-4.3.11.deb <username>@172.16.50.4:
  • Now, head to Jump
sudo WAZUH_MANAGER='172.16.200.10' WAZUH_AGENT_GROUP='linux' dpkg -i ./wazuh-agent-4.3.11.deb
sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent
⚠️ **GitHub.com Fallback** ⚠️