Two related sshd configuration questions.
I want to implement sshd so that it allows port forwarding but in a rather
specific manner. I can't alter what the client will do for various reasons,
but it's in essence:
ssh -l user-service -L 9999:server2.example.com:1234 server1.example.com
What the sshd server needs to do is:
1. Authenticate the username passed (in the former "user-service") against
an external authentication database. I am hoping I can do this using (say)
a PAM module. Whatever the username specified, the UNIX UID required on the
server will the same. As the username is in fact a composite of a username
and a service name, the usernames provided cannot correspond to actual UNIX
usernames. Is it possible to write a PAM module for sshd that works this
way, and if so how can I force logins to a specific UID?
2. Rather than sshd opening up TCP connection to forward the connection (in
the above instance to server2.example.com:1234), I need sshd to launch a
process (in a similar way to inetd) and pipe the connection to that,
irrespective of what the user has specified on the ssh command line. It
needs to pass the username specified ("user-service", not the UID which
will always be the same) and preferably the "server2.example.com:1234" to
this process, either on the process's command line or in the environment.
Essentially what the process will be doing is an "nc" but dependent on the
"user-service" tuple passed and subject to some protocol translation. How
can I achieve this?
If the answer is "go hack about in openssh sources" that is a possibility
(though I'd rather not). Some indication of where to look would be useful.
--
Alex Bligh
I want to implement sshd so that it allows port forwarding but in a rather
specific manner. I can't alter what the client will do for various reasons,
but it's in essence:
ssh -l user-service -L 9999:server2.example.com:1234 server1.example.com
What the sshd server needs to do is:
1. Authenticate the username passed (in the former "user-service") against
an external authentication database. I am hoping I can do this using (say)
a PAM module. Whatever the username specified, the UNIX UID required on the
server will the same. As the username is in fact a composite of a username
and a service name, the usernames provided cannot correspond to actual UNIX
usernames. Is it possible to write a PAM module for sshd that works this
way, and if so how can I force logins to a specific UID?
2. Rather than sshd opening up TCP connection to forward the connection (in
the above instance to server2.example.com:1234), I need sshd to launch a
process (in a similar way to inetd) and pipe the connection to that,
irrespective of what the user has specified on the ssh command line. It
needs to pass the username specified ("user-service", not the UID which
will always be the same) and preferably the "server2.example.com:1234" to
this process, either on the process's command line or in the environment.
Essentially what the process will be doing is an "nc" but dependent on the
"user-service" tuple passed and subject to some protocol translation. How
can I achieve this?
If the answer is "go hack about in openssh sources" that is a possibility
(though I'd rather not). Some indication of where to look would be useful.
--
Alex Bligh
