Security Flaws: AFP-over-SSH Broken
By admin on Friday, August 11 2006, 01:06 - bug - Permalink
After a discussion with Rich Mogull, where we both agreed that AFP is a threat (note that Apple fixed 4 different AFP threats in Security Update 2006-004), I decided to require ssh tunneling for AFP connections to www.reppep.com. Apple provides a neat feature for automatically tunneling AFP through ssh, but unfortunately it's broken in half a dozen ways...
My initial report:
It is impossible to connect to an AFP server without access to port 548 -- this should work if ssh is available, and AFP-over-SSH is enabled. Instead, with 548 blocked by a firewall, the AFP connection times out -- even using an alias created when connected via AFP-over-SSH.
Connect To Server should accept afps://host as a scheme that specifies AFP-over-SSH. Instead it gets converted to afp://afps/host, which is wrong and nonfunctional.
It's impossible to require ssh for AFP from the server.
It's impossible to support AFP on the server without leaving port 548 open, even though with ssh tunnelling 548 shouldn't be needed.
Note: These are not exploits, but they are real problems with the security of Mac OS X (Server
Comments
edoug,
If you manage to make an AFP-over-SSH connection, I believe you get full encryption for your file transfers. The problem is that it doesn't work without AFP(-not-over-SSH) accessible to carry the initial connection, due to poor design.
This has two implications. First, this means I can't provide AFP-over-SSH access without allowing users to connect via AFP without SSH -- I want to require SSH for AFP, but Apple's implementation doesn't permit this. Second, I cannot simply firewall off port 548 without losing AFP entirely. Apple fixes major AFP bugs often enough that I don't want that port exposed to the Internet. As a result I no longer allow my (Internet) users AFP access. That's a shame.
There is a work-round for this, you can add an extra IP address to the loop-back device and then forward AFP to that manually.
In terminal, type:
sudo ifconfig lo0 add 127.0.10.10 sudo ssh username@gateway -L127.0.10.10:548:remotehost:548
(you need to be super user to forward ports < 1024 , also to run ifconfig)
then in the finder, connect to afp://127.0.10.10
this lets me contact an AFP server behind a firewall that only allows through SSH. You can also SSH directly into a client machine and forward AFP over that link in the same way.
sudo ssh username@clientmachine -L127.0.10.10:548:localhost:548
though this lacks the Apple 'it just works' elegance...
RichardG,
Does this actually work for you? First, I had to turn off Personal File Sharing on the client (since port 548 was in use). Once that was done, I ran "
sudo ssh -v pepper@www -L 127.0.10.10:548:localhost:548", and the output included:I'd think this indicated 548/tcp was still in use on my client, but "
netstat -an|grep 548" indicates it is not.More to the point, when I try to make an AFP connection to
afp://127.0.0.1, I get the expected error message because the AFP client refuses to talk to myself:[...] allowing remote SMB networking has a host of perils and secure, remote AFP connections have their own challenges. Isn’t there a simple and secure way to have share-like access to your remote [...]
Hey Reppep,
In order to get the tunneled version to work you must ifconfig first to add the extra address.
db:~ dbartlett$ sudo ifconfig lo0 add 127.0.10.10 db:~ dbartlett$ sudo ssh -L 127.0.10.10:548:REMOTEAFPHOST:548 dan@GATEWAYSSHHOST
It worked first time when I did both of those!
Dan,
That's a different issue. Mine is that the AFP client recognizes 127.0.0.* is the local host, and won't let me connect back to myself.