Server features on Goauld

Listening services

Mon, 01 Jan 0001 00:00:00 +0000

To allow agents to tunnel SSH connection over different transports, the server must expose the corresponding service, then decapsulate the traffic and forward it to the SSHD server.

Note

For all listeners, the listen address flag has the following format: [IP]:[PORT]

If no IP address is provided, the service will listen on all interfaces. However, the : is still required before the port

SSH

No encapsulation, directly exposed.

Deployment

Mon, 01 Jan 0001 00:00:00 +0000

Warning

Goauld is currently not designed to run behind a reverse proxy. In particular, the whitelisting feature will not work behind a reverse proxy.

Docker compose example

services:
 goauld_server:
 build:
 context: .
 args:
 - COMPRESS=1
 # platform: linux/amd64
 container_name: server
 image: goauld_server
 ports:
 - "X.X.X.X:53:53/tcp"
 - "X.X.X.X:53:53/udp"
 - "X.X.X.X:80:80"
 - "X.X.X.X:443:443"
 - "X.X.X.X:22222:22222"
 volumes:
 - ./certmagic:/root/.local/share/certmagic
 - ./Goauld.db:/app/Goauld.db
 - ./server_config.yaml:/app/server_config.yaml
 - ./binaries:/app/binaries

configuration file example

#Age private key used by the server.
age-privkey: ""

# Domains used to serve HTTP and WebSocket traffic.
http-domain:
- www.example.com

# Domains used to serve raw TLS traffic (SSH over TLS).
tls-domain:
- app.example.com

# Domain used to serve DNS-based traffic (SSH over DNS).
dns-domain: t.example.com

# Domain used to serve DNS-based traffic (SSH over DNS-ALT).
dns-domain-alt: s.example.com

# Address and port to bind for HTTP connections (port 0 = random).
http-listen-addr: :80

# Address and port to bind for HTTPS connections (port 0 = random).
https-listen-addr: :443

# Address and port to bind for SSH connections (port 0 = random).
ssh-listen-addr: :2222

# Address and port to bind for DNS connections (port 0 = random).
dns-listen-addr: :53

# Address and port to bind for QUIC connections (port 0 = random).
quic-listen-addr: :443

# Enable TLS support.
tls: true

# Path to the TLS private key file.
tls-key: ""

# Path to the TLS certificate file.
tls-cert: ""

# Email used when generating Let's Encrypt certificates.
letsencrypt-mail: mail@example.com

# Enable QUIC protocol support.
quic: true

# Enable DNS server for SSH-over-DNS connections.
dns: true

# Disable database usage.
db: false

# Path or filename of the database to use.
db-file-name: Goauld.db

# List of IP addresses allowed to access the /manage/ endpoint.
allowed-ips:
- 127.0.0.1
- 0.0.0.0/32

# Access token required for the /manage/ API endpoint.
access-token:
- TODO_TOKEN

# Admin token required for the /admin/ API endpoint.
admin-token:
- TODO_TOKEN

# HTTP Basic Auth credentials required to access the binaries endpoint.
binaries-basic-auth: username:password

# Filesystem path where agent binaries are stored.
binaries-path-location: ./binaries

DNS configuration

Three DNS records are required:

Access Control

Mon, 01 Jan 0001 00:00:00 +0000

Certain components should be accessible only by authorized users.

Admin endpoints
Management endpoints
SSH access from the client

IP allowlisting

The server accepts a list of authorized IPs to restrict the access of

The /admin/ endpoints
The /manage/ endpoints
SSH access from the client (using password authentication)

Warning

IF the server runs in a docker environment, the deployment should ensure that the remote IP address is correctly forwarded to the server

Healthcheck

Mon, 01 Jan 0001 00:00:00 +0000

To ensure tunnels are functioning correctly, some healthcheck scripts/tools are provided.

Warning

The provided healthchecks only verify that the SSHD server is reachable through the tunnel by checking the SSHD banner.

SSH over TLS

echo "00000000000000000000000000000000\n" | timeout 1 openssl s_client -quiet -connect $TLS_DOMAIN$:$TLS_PORT$ 2>/dev/null | grep -q "SSH-2.0-"

SSH over WebSocket

Building

go build -o ws-healthcheck ./healthcheck/websocket

Running

{ echo "" ; sleep 1; } | ws-healthcheck "wss://$WS_DOMAIN/wssh/00000000000000000000000000000000" 2>/dev/null

SSH over DNS

Building

go build -o dns-healthcheck ./healthcheck/dns/dnstt-client

Running

{ echo "00000000000000000000000000000000S" ; sleep 1; } | dns-healthcheck -udp "$DNS_SERVER:$DNS_SERVER_PORT" "$DNS_DOMAIN" 2>/dev/null | grep -q "SSH-2.0-"

Note

The “S” is required at the end of the echo

Agent Drop

Mon, 01 Jan 0001 00:00:00 +0000

In order to drop precompiled agents, a basicauth protected dirlisting is available through https://[SERVER]/binaries/.

To access this dirlisting, a custom password should be configured.

# HTTP Basic Auth credentials required to access the binaries endpoint.
binaries-basic-auth: user:password

Database

Mon, 01 Jan 0001 00:00:00 +0000

The server uses an SQLite database to store information regarding previously connected agents.

Given that agents perform a full connection flow at each start, the data stored in the database isn’t required.

Flag:

--no-db Disable the database on disk.
--db-file-name Path or filename of the SQLite file .