I have a client who is setting up a logging infrastructure involving a couple of DMZs forwarding logs into central logging points.
They have to pass compliance audits (SOX, PCI at least) and have some rather specific desires in regards to how they want the log traffic to move, and which servers *initiate* the connections.
Which is to say they want the internal servers to set up tunnels to the DMZ servers and then the forwarders use that tunnel to deliver logs back.
Lemme see if I can ascii art this:
central1----------------------------------dmz1 ____________________ / _____________________\ _/ / \ central2----------------------------------dmz2
Something like that.
Central1=10.10.1.2 Central2=10.9.1.2
DMZ1=172.18.0.5 DMZ2=172.20.0.5
Firewalls are in effect.
I have gotten it set up so that I can initiate a connection FROM Central1 to DMZ2.
[Tunnel_to_DMZ2] client = yes accept = 3002 connect = 172.20.0.5:5000
And
[Tunnel_from_Central1] accept = 5000 connect = 3000
Like I said, I can open a tunnel from Central1 to DMZ2, but can't get traffic to pass backwards--I get a message in the log saying the session is closed.
Is it possible to set stunnel up in a "reverse tunnel" mode--one where the connect is initiated from one end, but the other does most of the message passing?
What I am missing?
Thanks, Petro.
On Tue, Jul 17, 2018 at 10:51:07PM -0600, C. Petro wrote:
I have a client who is setting up a logging infrastructure involving a couple of DMZs forwarding logs into central logging points.
They have to pass compliance audits (SOX, PCI at least) and have some rather specific desires in regards to how they want the log traffic to move, and which servers *initiate* the connections.
Which is to say they want the internal servers to set up tunnels to the DMZ servers and then the forwarders use that tunnel to deliver logs back.
Lemme see if I can ascii art this:
central1----------------------------------dmz1 ____________________ / _____________________\ _/ / \ central2----------------------------------dmz2
Something like that.
Central1=10.10.1.2 Central2=10.9.1.2
DMZ1=172.18.0.5 DMZ2=172.20.0.5
Firewalls are in effect.
I have gotten it set up so that I can initiate a connection FROM Central1 to DMZ2.
[Tunnel_to_DMZ2] client = yes accept = 3002 connect = 172.20.0.5:5000
And
[Tunnel_from_Central1] accept = 5000 connect = 3000
Like I said, I can open a tunnel from Central1 to DMZ2, but can't get traffic to pass backwards--I get a message in the log saying the session is closed.
So you are saying that the connection is established successfully? (you can check that in the logs of both stunnel instances and also using e.g. netstat or ss or similar tools on the hosts that should be talking to each other through the tunnel) ...but then, some indeterminate time later, one of the hosts tries to send some data through this connection and gets a connection reset or something like that?
If so, this sounds like something I've seen *a lot* with firewalls and other devices that try to keep track of connections passing through them (e.g. for NAT and such) - the firewall/NAT/whatever decides that there has been no traffic on that particular connection for, say, the last 15 minutes, so it drops it from its internal state - *obviously* those hosts do not need to talk to each other any more, who would ever have a 15-minute pause in a TCP connection, why would anybody want that? So the next time one of the hosts tries to send some data, the firewall/NAT/whatever says "hm, well, I don't know anything about this connection that you think you have, so, yeah, no".
TL;DR: maybe you should check the settings on some of the firewall devices and see if you can somehow raise the timeouts for inactive connections or something like that.
Is it possible to set stunnel up in a "reverse tunnel" mode--one where the connect is initiated from one end, but the other does most of the message passing?
What I am missing?
Hope the above helps.
G'luck, Peter
On Tue, Jul 17, 2018 at 10:51:07PM -0600, C. Petro wrote:
I have a client who is setting up a logging infrastructure involving a couple of DMZs forwarding logs into central logging points.
They have to pass compliance audits (SOX, PCI at least) and have some rather specific desires in regards to how they want the log traffic to move, and which servers *initiate* the connections.
Which is to say they want the internal servers to set up tunnels to the DMZ servers and then the forwarders use that tunnel to deliver logs back.
...oof. I went back and reread your original message more carefully. The truth is, stunnel cannot really do what you want :(
It seems to me that what you want could be accomplished with OpenSSH and its remote connection forwarding: set up an SSH server in the DMZ, generate a (possibly passphraseless) key pair on the central server, add the public key to an the authorized_keys file of an unprivileged account on the DMZ server, and then, on the central server (again, from an unprivileged account), run a command like:
ssh -N -R 3000:localhost:3000 [email protected]
Then SSH will listen for incoming connections on 127.0.0.1:3000 on the DMZ server and, when a connection comes in, create a connection from 127.0.0.1 to 127.0.0.1:3000 on the central server and start forwarding data.
If needed, the OpenSSH server on the DMZ host may be configured so that it is very restricted: only public-key authentication, only certain users may connect, only certain commands may be executed, etc.
Apologies for not reading your first message carefully enough!
G'luck, Peter
-
C. Petro -
Peter Pentchev