The LICOS mobile rack is isolated from SLAC Central Unix systems by a pair of firewalls, one at B33, and one in the rack itself. However, ssh port forwarding can provide the appearance that software clients running on the mobile rack are able to communicate directly with their corresponding server applications on Central Unix hosts. To achieve this connectivity, an intermediate host located between (in a network sense) the two firewalls can be used to chain together a pair of ssh forwarding tunnels for each application / protocol. In the following configuration description, the Central Unix host at the SLAC end of the tunnels is 'glast02', the intermediate machine behind the ODS-DMZ firewall is 'dcm2', and the Mobile Rack bastion host is 'lat-dmz0x'.
An open-source utility called 'autossh' is used as a wrapper to invoke the ssh client processes that establish the forwarding tunnels. This utility will restart the client process if it terminates for some reason; in addition, it "piggybacks" a monitoring connection through a parallel tunnel to detect network partition conditions.
The two firewalls are configured such that 'dcm2' can initiate outbound ssh connections towards either the mobile rack or Central Unix, but inbound connections to 'dcm2' are blocked. Therefore 'dcm2' must initiate both sets of tunnels. Accordingly, the following modifications are necessary to the configuration of 'dcm2' (which is a Taylored machine with access to AFS and NIS)
- A local home directory for the 'glastops' account is created on dcm2.
- The NIS home directory setting for 'glastops' is overridden on dcm2 by adding a record to the /etc/passwd file.
- SSH Protocol-2 RSA and DSA key-pairs are created for the glastops account on dcm2, and the public keys are added to ~/.ssh/authorized_keys2 for glastops on both glast02 and lat-dmz0x.
- A SysV-style boot-time script is installed in /etc/init.d on dcm2 to invoke the individual autossh-wrapped ssh client instances for each forwarded service.
- The -R invocation is used to create the tunnels between dcm2 and lat-dmz0x.
- The -L invocation is used for the tunnels between dcm2 and glast02.
- For each service, the destination port of the -R tunnel with lat-dmz0x corresponds to the originating port of the -L tunnel with glast02.
The following options must be edited / added to /etc/ssh/sshd_config on lat-dmz0x:
- "AllowTcpForwarding yes"
- "GatewayPorts yes"
The boot-time script is as follows:
- FASTCopy: Since lat-dmz01:40000 is effectively redirected to glast02:40000, the fcopyd daemon that would normally listen for incoming FASTCopy transfers must be disabled on lat-dmz01. Thus it is not possible to perform a FASTCopy transfer to lat-dmz01, only from lat-dmz01 to glast02.
- MySQL: The LICOS Electronic Log (ELog) application uses a MySQL database running local to the mobile rack on lat-dmz01. This database's mysqld listens on the "standard" MySQL port 3306. Therefore, port 3307 on lat-dmz01 is redirected to glast03:3306 for access to the MOOD and FMX databases.
- CVS: Access to the LAT Flight Software CVS repository in support of the CMX build tool requires some per-user configuration in order to make use of the tunnel to centaurusa:
- Each user must create ssh public-private key pairs for their mobile-rack account, and install their mobile-rack public keys in user@centaurusa:~/.ssh/authorized_keys and user@centaurusa:~/.ssh/authorized_keys2.
- Each user must
export CVSROOT=:ext:lat-dmz01:/nfs/slac/g/glast/flight/archivein their mobile-rack account.
- Each user must add the following lines to user@lat-dmz01:~/.ssh/config: