Useful Commands/Security: Difference between revisions

From Fundamental Ramen
Jump to navigation Jump to search
Line 208: Line 208:
</source>
</source>
|
|
<quickgv name="LS4" theme="warm">
rankdir=TB;
subgraph cluster_home {
  label="Home";
  A [label="browser https://www.google.com"];
  B [label="sudo socat ... udp4-recvfrom:53 ..."];
}
subgraph cluster_office {
  label="Office";
  C [label="ssh -NCfR ..."];
  D [label="socat ... tcp4-listen ..."];
  E [label="DNS Server"];
  F [label="ssh -NCfR 3128: ..."];
  G [label="ssh -NCfD ..."];
  H [label="HTTP Server"];
}
// DNS Routing
A -> B [label="1 udp"];
B -> C [label="2 ssh"];
C -> D [label="3 tcp"];
D -> E [label="4 udp"];
E -> D [label="5 udp"];
D -> C [label="6 tcp"];
C -> B [label="7 ssh"];
B -> A [label="8 udp"];
// SOCKS Routing
A -> F [label="socks"];
F -> G [label="ssh"];
G -> H [label="http"];
H -> G [label="http"];
G -> F [label="ssh"];
F -> A [label="socks"];
</quickgv>
|}
|}

Revision as of 08:41, 23 February 2019

Frequently Used Commands

TODO Command
Indirect outgoing for PostgreSQL 
# [Private]
# localhost -> localhost:15432
#           -> server:22
#           -> somewhere.com:5432
ssh -NCfL 15432:somewhere.com:5432 server

# [Shared]
# any -> *:15432
#     -> server:22
#     -> somewhere.com:5432
ssh -NCfL *:15432:somewhere.com:5432 server
Indirect outgoing for Web 
# [Private]
# localhost -> localhost:3128
#     -> server:22
#     -> *:*
ssh -NCfD localhost:3128 server

# [Shared]
# any -> *:3128
#     -> server:22
#     -> *:*
ssh -NCfD *:3128 server
Share MariaDB in LAN 
# Step 1: Listen (Run at LAN)
# Listen server:13306 -> server:22
#                     -> localhost:3306
ssh -NCfR 13306:localhost:3306 server

# Step 2: Share (Run at Home/WAN)
# any -> server:3306
#     -> server:13306
#     -> server:22
#     -> localhost:3306
ssh -NCfL *:3306:localhost:13306 localhost
List tunnels 
# List full commands.
ps ax | awk '/ssh \-NCf/ { print $0 }'

# List settings.
ps ax | awk '/ssh \-NCf/ { print $7 }'

# List pids.
ps ax | awk '/ssh \-NCf/ { print $1 }'

# Kill all tunnels.
kill $(ps ax | awk '/ssh \-NCf/ { print $1 }')
Generate key pair 
# Save as default name id_rsa, id_rsa.pub
ssh-keygen
# Save as thefuck, thefuck.pub without password
ssh-keygen -f abc -N ''
# Save as thefuck, thefuck.pub with password 
ssh-keygen -f abc -N '12345'
Generate public key from private key 
# Dump
ssh-keygen -yf thefuck.pem
# Save as file
ssh-keygen -yf thefuck.pem > thefuck.pub
# Save as authorized_keys (while ~/.ssh/authorized_keys didn't exist)
ssh-keygen -yf thefuck.pem > authorized_keys
# Append into authorized_keys
ssh-keygen -yf thefuck.pem >> authorized_keys

Connect to internal resources without VPN

Lesson 1: UDP -> UDP

Command Routing 
sudo socat -d -d \
  udp4-recvfrom:53,bind=127.0.0.1,fork \
  udp4-sendto:8.8.8.8:53

Lesson 2: UDP -> TCP -> UDP

Command Routing 
sudo socat -d -d \
  udp4-recvfrom:53,bind=127.0.0.1,fork \
  tcp4:127.0.0.1:1053

socat -d -d \
  tcp4-listen:1053,bind=127.0.0.1,fork \
  udp4-sendto:8.8.8.8:53

Lesson 3: UDP -> SSH -> TCP -> UDP

Command Routing 
# Step 1. SSH -> TCP -> UDP (Run at Office)
socat -d -d -lf socat.log \
  tcp4-listen:1053,bind=127.0.0.1,fork \
  udp4-sendto:192.168.1.1:53 &

ssh -NCfR 1053:127.0.0.1:1053 home

# Step 2. UDP -> TCP -> SSH -> TCP -> UDP (Run at Home)
sudo socat -d -d -lf socat.log \
  udp4-recvfrom:53,bind=127.0.0.1,fork \
  tcp4:127.0.0.1:1053 &

Lesson 4: Forward HTTP

Command Routing 
# Run at office
ssh -NCfD 127.0.0.1:3128 localhost
ssh -NCfR 3128:127.0.0.1:3128 home

Retrieved from "https://wiki.fundamental-ramen.com/index.php?title=Useful_Commands/Security&oldid=484"