Category: NewsNew Security Feature: Remote Assistance

Share this post...Tweet about this on TwitterShare on Google+0Share on Facebook0

InterWorx’s new feature makes it possible to get support without supplying a root password.

Recently InterWorx has introduced a new feature to our control panel to vastly improve the security for our clients who seek technical support.

Remote Assistance

Remote Assistance adds additional layers of security for our clients. It provides a way for the NodeWorx administrator to permit root SSH access for InterWorx Support without a root password. In fact, root user login need not even be enabled. The feature greatly simplifies receiving technical support for the control panel and also goes a long way to protect our clients and their servers. Keep in mind that InterWorx support cannot gain access to a server without a master NodeWorx user or root Linux user explicitly activating Remote Assistance. This is not a backdoor.

How To Use

From Inside NodeWorx

    1. First, locate the new Remote Assistance Menu item on the NodeWorx menu. It may look like one of the following depending on which menu style is being used:
      Small Menu Style:

      Big Menu Style:

    2. Second, turn Secure Support Account ON
  1. Lastly, open the support ticket with the details shown on this screen. It is not necessary to provide a root password but please mention that Remote Assistance is enabled.

Remote Assistance can be disabled at any time, even if a technician is currently logged in. They will be disconnected immediately. Also, our technicians are instructed to disable the feature when leaving after an issue is resolved.

From Command-Line (in the event of NodeWorx not working)

  1. We designed this feature knowing that occasionally NodeWorx may be inaccessible. Run the following command as root:
    /usr/local/interworx/bin/enable-support-access.sh
  2. Disable with the following command:
    /usr/local/interworx/bin/disable-support-access.sh

How it Works

  1. When activating Remote Assistance, InterWorx will first connect to license.interworx.com and retrieve the SSH public key support will use to connect. Keep in mind that the private key is only on one machine: a login proxy server that our technicians use to “bounce” to the server.
  2. The key is then cryptographically verified to ensure its authenticity.
  3. Next, a Linux user called “iworx_support_user” is created. The retrieved public key added to its authorized_keys file.
  4. The InterWorx login proxy’s IP is added to sshd’s hosts_allow file.
  5. The sshd config is edited to allow the iworx_support_user to login if AllowUsers or AllowGroups is set.
  6. Then, sudo privileges for iworx_support_user are setup.
  7. The login proxy’s IP is whitelisted in the firewall.
  8. Lastly, Remote Assistance is set to disable itself within 24 hours.

Naturally, disabling Remote Assistance undoes the above actions.

Why This Improves Security

We feel this is vastly superior to providing a root password for the following reasons:

  • If you use Remote Assistance, your root password never is sent across the internet and is never stored in any databases.
  • If you use Remote Assistance, there is no need to have root login enabled or even a password set for the root user.
  • All data entered in server information fields inside of a support ticket is now encrypted – even the IP address and SSH port.
  • The public SSH key can be changed on the fly by us remotely at will. Since the key is downloaded every time the feature is activated, you are never in danger of activating remote assistance with an old key that may have been compromised.
  • This key is cryptographically verified to ensure that it has not been tampered with.
  • Remote Assistance will disable itself after 24 hours automatically so the feature can’t accidentally be left on indefinitely.
  • Server Administrators have full control of the feature and can disable it at any time after its activated if they feel the need, even without expertise in command-line or Linux.
  • The system is very transparent, and the mechanisms which open access to your server can be seen by reading the code inside the following files:
    • /usr/local/interworx/bin/enable-support-access.sh
    • /usr/local/interworx/bin/disable-support-access.sh

We and our clients take server security very seriously, and we think this new feature will go a long way in allowing all our clients to adopt excellent server security practices.

Apr 20, 2011, 9:08 pmBy: InterWorx (0) Comments

Leave a Reply
Surround code blocks with <pre>code</pre>

Your email address will not be published.

Forum Posts

  • SSL Certificate Option December 5, 2016
    Hi, Question, I have 12 domain being hosted within my Interworx CP. Why would only some of them, whe […]
    hostpanda
  • Turing off catchall results in mailbox failure December 5, 2016
    Hi all, a custopmer wanted a catchall adress set up but now realized he gets way too much spam that […]
    mdeinhardt
  • Catchall December 5, 2016
    We have some clients who still like to use a catchall address even though we strongly discourage it […]
    Bertie