Looking Glass: FRRouting (FRR) configuration and tips.

FRR has its roots in the Quagga project. In fact, it was started by many long-time Quagga developers who combined their efforts to improve on Quagga's well-established foundation in order to create the best routing protocol stack available. We invite you to participate in the FRRouting community and help shape the future of networking.

Instalation FRRouting

  • https://github.com/FRRouting/frr/tree/master/doc

Security and user access

Looking Glass directly calls vtysh -c "frr command". Thus, the lg user only needs to run vtysh, ping and traceroute. To achieve this, we recommend the use of rbash (restricted bash, see [1]), ssh key based authentication and a bit of dark magic.

Configuration

Rough steps ahead (maybe more doc later):

# create the "lg" unix user and add it to 'frr' and 'frrvty' group's.
root@frr-router ~# adduser lg
(boring questions)
root@frr-router ~# pw group mod frr -m lg
root@frr-router ~# pw group mod frrvty -m lg

# log in as lg user
root@frr-router ~# su -l lg

# create ssh userdir and authorized the looking glass RSA pubkey with limited access and features
lg@frr-router ~# mkdir ~/.ssh/
lg@frr-router ~# echo 'from="lg.example.com,$IP4-OF-YOUR-LG",no-port-forwarding,no-x11-forwarding,no-agent-forwarding ssh-rsa $RSA-PUBKEY-HERE lg@looking-glass' >| ~/.ssh/authorized_keys

# truncate the profile dotfile
lg@frr-router ~# echo >| ~/.profile

# set up a limited PATH
lg@frr-router ~# echo "export PATH=/opt/lg-bin" >| ~/.profile
lg@frr-router ~# exit

# render the profile dotfile immutable, the lg user will not be able to truncate/edit it
root@frr-router ~# chattr +i ~lg/.profile

# change lg user shell to restricted bash
root@frr-router ~# chsh -s /bin/rbash lg

# set up the restricted PATH with the only necessary binaries simlinks
root@frr-router ~# mkdir -p /opt/lg-bin
root@frr-router ~# for cmd in vtysh ping traceroute; do ln -s $(which $cmd) /opt/lg-bin/; done
root@frr-router ~#

You can disable password authentication for the lg user in the sshd config:

Match user lg
  PasswordAuthentication no

and reload sshd:

service ssh reload

Debug

Test the SSH connection from the server where the looking glass is installed:

ssh -i lg-user-id_rsa.key lg@frr-router.example.com

After successful login, verify that only built-in functions and vtysh, ping and traceroute are available and functionnal.

References

  • [1] http://en.wikipedia.org/wiki/Restricted_shell