H 130: sslh (10 pts)

What You Need for this Project

• A Linux machine--I used a Google Cloud Debian 10 server

Purpose

Adjusting the Google Cloud Firewall

In the "VM instances" page, on your Debian instance's line, on the right side, click the three-dot icon and click "View network details".

On the left side, click Firewall.

At the top center, click "CREATE FIREWALL RULE".

Enter these values, as shown below.

• Name: http
• Targets: All instances on the network
• Source filter: IP ranges
• Source IP ranges: 0.0.0.0/0
• Protocols and ports: Specified protocols and ports
• tcp: 80,443

Installing Apache

sudo apt update
sudo apt install apache2 -y
sudo ss -nltp

Testing your Web Server

http://35.188.199.249

An Apache page opens, as shown below.

Installing sslh

sudo apt install build-essential git  -y
sudo apt install libconfig-dev libwrap0-dev -y
sudo apt install libsystemd-dev libpcre3-dev -y
sudo apt install libcap-dev libbsd0 libbsd-dev -y

git clone https://github.com/yrutschle/sslh.git
cd sslh

make

sudo cp sslh-fork /usr/local/sbin/sslh
sudo cp basic.cfg /etc/sslh.cfg
sudo cp scripts/etc.init.d.sslh /etc/init.d/sslh
sudo ln -s /usr/local/sbin/sslh /sbin/sslh 

sudo nano /etc/sslh.cfg
          

• Add a # to comment out the "chroot" line
• Change the hostname to 0.0.0.0

Press Ctrl+X, Y, Enter to save the file.

Starting sslh

sudo /etc/init.d/sslh start
sudo ss -ntlp

Testing sslh for HTTP

http://35.188.199.249:443

An Apache page opens, as shown below.

Testing sslh for SSH

Execute this command, replacing the IP address with the public address of your server running sslh:

ssh 35.188.199.249 -p 443

Flag H 130.1: Nmap Scan (10 pts) Use another Linux system, such as a second Debian cloud server. Execute these commands, replacing the IP address with the public address of your server running sslh: sudo apt install nmap -y sudo nmap 35.188.199.249 The flag is the service Nmap detects, covered by a green rectangle in the image below.

References