Configuring SSF for Port Forwarding

#

To configure SSF you have to do different things on the server with the public facing IP and on the client which runs the service you want to forward.

Install SSF

#

Do on both Server and Client

#

Download SSF: SSF - Secure Socket Funneling - Network tool - TCP and UDP port forwarding, SOCKS proxy, Remote shell, Native Relay protocol, Standalone

Extract to /opt/ssf

# unzip *.zip /opt/ssf

Setup keys

#

SSF - Secure Socket Funneling - Network tool - TCP and UDP port forwarding, SOCKS proxy, Remote shell, Native Relay protocol, Standalone

Do on both the Server and Client

#

Generate Diffie-Hellman parameters

# openssl dhparam 4096 -outform PEM -out dh4096.pem

Do on the Client

#

Generate a Certificate Authority

# openssl req -x509 -nodes -newkey rsa:4096 -keyout ca.key -out ca.crt -days 3650

Copy to Server

#

# scp /opt/ssf/certs/ca.* user@<server-ip>:/opt/ssf/certs/

Do on both the Server and Client

#

Create ’extfile.txt':

# touch extfile.txt

[ v3_req_p ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca_p ]
basicConstraints = CA:TRUE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyCertSign

Generate private key and certificate (leave fields blank):

# openssl req -newkey rsa:4096 -nodes -keyout private.key -out certificate.csr

# openssl x509 -extfile extfile.txt -extensions v3_req_p -req -sha1 -days 3650 -CA ca.crt -CAkey ca.key -CAcreateserial -in certificate.csr -out certificate.crt

# cat ca.crt » certificate.crt

Encrypt private key with password:

# openssl rsa -in private.key -out private.key -aes256 -passout pass:<password>

Move ca.crt to Trusted Folder:

# mv /opt/ssf/certs/ca.crt /opt/ssf/certs/trusted/ca.crt

Create Configuration File for SSF

#

On Server

#

# touch /opt/ssf/ssf.conf

{
  "ssf": {
    "arguments": "",
    "circuit": [],
    "tls" : {
      "ca_cert_path": "/opt/ssf/certs/trusted/ca.crt",
      "cert_path": "/opt/ssf/certs/certificate.crt",
      "key_path": "/opt/ssf/certs/private.key",
      "key_password": "<server-private-key-password>",
      "dh_path": "/opt/ssf/certs/dh4096.pem",
      "cipher_alg": "DHE-RSA-AES256-GCM-SHA384"
    },
    "http_proxy" : {
      "host": "",
      "port": "",
      "user_agent": "",
      "credentials": {
        "username": "",
        "password": "",
        "domain": "",
        "reuse_ntlm": "true",
        "reuse_nego": "true"
      }
    },
    "services": {
      "datagram_forwarder": { "enable": false },
      "datagram_listener": {
        "enable": false,
        "gateway_ports": false
      },
      "stream_forwarder": { "enable": false },
      "stream_listener": {
        "enable": true,
        "gateway_ports": true
      },
      "copy": { "enable": false },
      "shell": {
        "enable": false,
        "path": "/bin/bash|C:\\windows\\system32\\cmd.exe",
        "args": ""
      },
      "socks": { "enable": false }
    }
  }
}

On Client

#

# touch /opt/ssf/ssf.conf

{
  "ssf": {
    "arguments": "",
    "circuit": [],
    "tls" : {
      "ca_cert_path": "/opt/ssf/certs/trusted/ca.crt",
      "cert_path": "/opt/ssf/certs/certificate.crt",
      "key_path": "/opt/ssf/certs/private.key",
      "key_password": "<client-private-key-password>",
      "dh_path": "/opt/ssf/certs/dh4096.pem",
      "cipher_alg": "DHE-RSA-AES256-GCM-SHA384"
    },
    "http_proxy" : {
      "host": "",
      "port": "",
      "user_agent": "",
      "credentials": {
        "username": "",
        "password": "",
        "domain": "",
        "reuse_ntlm": "true",
        "reuse_nego": "true"
      }
    },
    "services": {
      "datagram_forwarder": { "enable": false },
      "datagram_listener": {
        "enable": false,
        "gateway_ports": false
      },
      "stream_forwarder": { "enable": true },
      "stream_listener": {
        "enable": false,
        "gateway_ports": true
      },
      "copy": { "enable": false },
      "shell": {
        "enable": false,
        "path": "/bin/bash|C:\\windows\\system32\\cmd.exe",
        "args": ""
      },
      "socks": { "enable": false }
    }
  }
}

Configure Systemd Services

#

# /etc/systemd/system/ssf-server.service

[Unit]
Description=SSF Server Service
After=network.target

[Service]
User=root
ExecStart=/opt/ssf/ssfd -p <port-to-host-ssf-on> -c /opt/ssf/ssf.conf -g

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/ssf-client.service

[Unit]
Description=SSF Client Service
After=network.target

[Service]
User=root
ExecStart=/opt/ssf/ssf -R 0.0.0.0:<port-to-forward>:127.0.0.1:<port-to-forward> -p <port-to-host-ssf-on> <server-public-ip> -c /opt/ssf/ssf.conf -g

[Install]
WantedBy=multi-user.target

Enable Services and Start Them

#

On Server

#

# systemctl enable ssf-server.service

# service ssf-server start

On Server

#

# systemctl enable ssf-client.service

# service ssf-client start