Difference between revisions of "SSH Tunneling for CPRS"

Revision as of 00:08, 5 December 2006

Marc Krawitz contributed this tutorial to Hardhats. It is reproduced here as it appeared on Hardhats@googlegroups.com. 11/29/2006 9:11 PM

[Hardhats] Tutorial on ssh tunneling with CPRS

It took me all day to figure this out, so I thought I would share. The goal here is to enable CPRS to work remotely by communicating over the public internet when the target VistA linux server only exposes port 22 (ssh). The channel needs to be (and is) encrypted of course.

To do this, make the following changes to /etc/ssh/sshd_config on your linux server:

AllowTcpForwarding yes
GatewayPorts yes
TCPKeepAlive yes
ClientAliveInterval 10
ClientAliveCountMax 99999

Restart sshd:

/etc/init.d/sshd restart

Next, create a dedicated linux account with username 'remoteaccess'. This account will be used to handle the ssh connections. In this example, I will use an example password of remotepw. For security purposes, change the shell of 'remoteaccess' to rbash which is a restricted shell:

chsh -s /usr/bin/rbash remoteaccess

Next, edit the .bashrc file for remoteaccess as follows:

trap exit SIGINT SIGTERM SIGQUIT SIGHUP
stty susp \000
echo "For remote access to VistA only..."
while [ true ]
do
       sleep 60000000
done

You are now done setting things up on the linux side. Now we proceed with the Windows client which runs CPRS:

1) Obtain plink.exe from the web. Its essentially a command line version of putty.

2) Create the following shortcut on your desktop. This assumes you have your RPC broker on linux listening on port 9000. Change as needed. local-ip-of-linux-server is the internal ip address of the linux server on the network in which it resides. remote-ip-of-linuxserver is the ip address used to access it on the public internet.

plink.exe -N -ssh -l remoteaccess -pw remotepw -L
9000:local-ip-of-linux-server:9000 remote-ip-of-linuxserver

(local-ip-of-linux-server will normaly be 127.0.0.1)

Configure the shortcut to run minimized.

3) Create the following second shortcut on your desktop:

CPRSChart.exe S=localhost P=9000 CCOW=DISABLE

To get this work, simply start the 1st shortcut and leave it running minimized on your taskbar for the duration of the time in which you will be using CPRS. Then click on the second shortcut to start CPRS. All communication between CPRS and the server should then occur over the encrypted connection established by plink on port 22.

If anyone has suggestions for improvement, feel free to comment. Also, please review for security holes.

Thanks,

Marc

--gra'pa Z 20:57, 1 Dec 2006 (CST)