Re: Useradd command/Encrypted Putty Session (SSH Client)

Forgive me if this question is too mediocre for this list but my 
question involved a secure session spanning from putty to our leaf 6x box.

Is there a way to:

A: Create  a limited non-root user in leaf

B: Create a open port for an RDP session to a terminal server(I got this 
portion, but just wanted to mention it as a point of reference!)

C: *The big one* Limit the user and/or putty session so the connecting 
user can't make any changes to the firewall.

I'm trying to create something similar to a VPN client. Unless you 
awesome individuals can offer a better tool for what I'm trying to 
do.....? :-)

In advanced thanks so much!

On 9/20/2020 7:18 AM, [email protected] wrote:
> Send leaf-user mailing list submissions to
> 	[email protected]
>
> To subscribe or unsubscribe via the World Wide Web, visit
> 	https://lists.sourceforge.net/lists/listinfo/leaf-user
> or, via email, send a message with subject or body 'help' to
> 	[email protected]
>
> You can reach the person managing the list at
> 	[email protected]
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of leaf-user digest..."
>
>
> Today's Topics:
>
>     1. Re: wireguard in leaf-bering-uclibc 6.2 ? (Boris)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Sat, 19 Sep 2020 19:50:21 +0200
> From: Boris <[email protected]>
> To: Steve Tell <[email protected]>
> Cc: Leaf-User List <[email protected]>
> Subject: Re: [leaf-user] wireguard in leaf-bering-uclibc 6.2 ?
> Message-ID: <[email protected]>
> Content-Type: text/plain; charset=utf-8
>
> Wow Steve,
>
> good step! Thank you! I will try to follow your notes...
>
> Boris
>
> Am 17.09.20 um 05:19 schrieb Steve Tell:
>> I've been fiddling around for a couple of evenings, and I believe I have
>> wireguard working correctly on 6.2.6.
>>
>> Here are some notes, in a form resembling a very rough tutorial document:
>> The biggest hurdles were finding the right things to put into
>> /etc/network/interfaces, and discovering that the android app will
>> import the same syntax of /etc/wireguard/wg*.conf as used on the server.
>>
>>
>> wireguard on leaf-bering-uclibc:
>>
>> add wireguard.lrp to leaf.cfg
>>
>> add wireguard to /etc/modules
>> save config and reboot
>>
>> create the four keys following the tutorials
>> ????but there's no "tee" (why not, busybox?), so use:
>>
>> wg genkey > fwall.private
>> wg pubkey? < fwall.private > fwall.pub
>>
>> the other pair for the remote peer, in my case a cellphone:
>>
>> wg genkey > phone.private
>> wg pubkey? < phone.private > phone.pub
>>
>> now make the firewall /etc/wireguard/wg0.conf using that info
>>
>> edit /etc/wireguard/wg0.conf
>> [Interface]
>> # note no Address keyword, contrary to some tutorials
>> ListenPort = 51820
>> PrivateKey =?? (firewall private key from fwall.private
>>
>> [Peer]
>> PublicKey = (this peer's public key, from phone.pub)
>> AllowedIPs = 10.x.y.z??????? # /32 address permanently assigned to this
>> peer
>>
>>
>> the wg-quick script doesn't work on bering, I think because it needs
>> some features missing in busybox.? o
>>
>> so, proceed almost as if we had a real ethernet interface named wg0:
>>
>> edit /etc/network/interfaces, to add:
>>
>> # wireguard vpn
>> # replace 10.x.x.* with same subnet as used in peer AllowedIPs? in wg0.conf
>> iface wg0 inet static
>> ??????? address 10.x.y.1
>> ??????? netmask 255.255.255.0
>> ??????? pre-up ip link add dev wg0 type wireguard
>> ??????? pre-up wg setconf wg0 /etc/wireguard/wg0.conf
>> ??????? post-up ip route add 10.x.y.0/24 dev wg0
>> ??????? post-down ip link delete dev wg0
>>
>> check dnsmasq.conf, make sure that dnsmasq will accept DNS queries from wg0
>> (interface=, except-interface= options)
>>
>> add wg0 interface and vpn zone to shorewall:
>>
>> interfaces:
>> ????vpn????????? wg0???????????????????? logmartians
>> snat:
>> ????MASQUERADE???? 10.x.y.0/24?????? eth0
>> policy:
>> ????vpn????????????? all???????????? ACCEPT
>> # or, I think rules:
>> rules:
>> ????HTTP(ACCEPT)??? vpn????????? loc
>> ????etc
>>
>> ---
>>
>> next, build a config file to transport to the peer machine.
>> in my case, the peer is an android phone with the wireguard app from
>> fdroid.
>>
>> I called this file phone.wg.conf:
>>
>> # phone/road-warrior wireguard config
>> [Interface]
>> Address = 10.x.y.z/32? # same as peer AllowedIP on the firewall side.
>> ListenPort = 51820
>> PrivateKey = (from phone.private file generate above)
>>
>> # Peer1: home firewall
>> [Peer]
>> PublicKey = (from phone.pub generated above)
>> #AllowedIPs = 0.0.0/0 ::/0?? # I think this is right, but I entered it
>> manually instead.
>>
>>
>> Then, copy this config file to the phone. I used MTP over USB, and put
>> it in the downloads directory.
>> open the wireguard app.
>> click "+" to add a tunnel, and "import from file".
>> select downloads/phone.wg.conf
>>
>> the keys get imported.
>> then manually configure these two things:
>>
>> Interface:
>> ????DNS Servers: 10.x.y.1
>> ??????????? the IP addr of the firewall's wg0 interface
>> ??????????? on which dnsmasq should be listening
>> Peer:
>> ????Allowed IPs: 0.0.0.0/0 ::/0
>> ??????? this is right for tunneling all traffic
>> ??????? somthing more interesting might allow split tunneling.
>>
>> It must be possible to put this stuff into phone.wg.conf, because some
>> commercial vpn services provide a tool to generate and download a
>> wireguard config file.
>>
>> Flip the switch in the wireguard app to turn on the tunnel.
>> use "wg show" on the firewall to see the connection.
>>
>> some debug aids I used:
>> ?"ping" and "nslookup" in termmux on android
>> ?"wg show" on firewall
>> ?logfiles on firewall
>>
>> note that nslookup (and dig) in termmux don't use whatever mechanism
>> android normally uses to find the dns server, they always use a
>> resolv.conf file with google servers only.
>> but "nslookup lan-machine 10.x.y.1" should query dnsmasq on the firewall
>> for its view of the world.
>>
>>
>>
>>
>>
>>
>>
>> On Mon, 14 Sep 2020, Boris wrote:
>>
>>> Am 09.09.20 um 17:19 schrieb Steve Tell:
>>>> 6.2.6 has a wireguard.lrp package that installs /usr/bin/wg and related
>>>> template config files.
>>>>
>>>> But no mention of wg in the mailing list or docs.? Anyone using
>>>> wireguard as server on leaf for a basic "road warrior" setup?? Does it
>>>> "just work" so easily there's no docs needed?
>>> Hej Steve,
>>>
>>> wireguard is on my tasklist. I tried once with 6.2.3 and stepped onto a
>>> missing component. In 6.2.5 this missing thing is fixed and I managed to
>>> generate keys. Next step would be to do the connection and routing but I
>>> have to wait for days with bad weather or longer nights ;-)
>>>
>>> Boris
>>>
>>>
>>> ------------------------------------------------------------------------
>>> leaf-user mailing list: [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/leaf-user
>>> Support Request -- http://leaf-project.org/
>
>
>
> ------------------------------
>
>
>
> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> leaf-user mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/leaf-user
>
>
> ------------------------------
>
> End of leaf-user Digest, Vol 156, Issue 8
> *****************************************
>


------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/