Problems with ipfw and ssh

[Giorgos Keramidas]

I removed freebsd-ipfw from the recipient list.  Please keep `general'
questions in freebsd-questions.  The freebsd-ipfw list is, as far as I
know, used for *development* of IPFW; not questions.

On 2006-10-11 22:53, Spiros Papadopoulos <spap13 at googlemail.com> wrote:
> Hi,
> 
> I am trying to configure a firewall using ipfw for a machine running
> FreeBSD 5.4.  Without NAT.
> 
> I am nearly a newbie on this (since i never had time until now..) but
> still i believe i understand exactly the concepts and what needs to be
> done.  Except the manual page and chapter 26.1 in the handbook I am
> using good references such as:
>
> http://www.freebsd-howto.com/HOWTO/Ipfw-HOWTO
> 
> I need to connect remotely to the machine using ssh and this is where
> i get the problem:
> 
> Initially i can connect properly using a normal user account.  When
> later i am trying to su to root it does nothing and the connection
> closes.

Can you show us the full IPFW ruleset you are using?

> I have ipfw enabled in the kernel to deny everything by default.  I
> have used both (one at a time) the following rules concerning ssh, in
> /etc/ipfw.rules and also other combinations, such as taking off setup
> and keep-state etc etc which would then make my firewall stateless as
> far as i understood, which is something i don't want anyway.
> 
> ${addcmd} 300 allow log logamount 5 tcp from any to me 22 setup keep-state
> -
> ${addcmd} 300 allow log logamount 5 tcp from any to any ssh keep-state

The second seems wrong, unless you also have 'setup' rules elsewhere.

> In a first investigation (not thorough) i found this post:
> http://www.freebsdforums.org/forums/showthread.php?t=21876
> where from, i cannot realize what is wrong or how to fix this.

The initial ruleset of this forum thread has a few bugs, which I'm not
interested in pointing out one by one right now.  Just ignore most of it.

> I run the sshd in debug mode and below is the portion, for when i am trying
> to su to root
> 
> /* sshd -d */
> Write failed: Permission denied
> debug1: do_cleanup
> debug1: PAM: cleanup
> debug1: do_cleanup
> debug1: PAM: cleanup
> debug1: session_pty_cleanup: session 0 release /dev/ttyp7

Now we're getting somewhere.  Please post your *FULL* ipfw ruleset so we
can try to find out why/when/where packets can be blocked.