SSH Authentication for custom C Server script using TCP on Linux, connected to by iOS app
I am currently trying to construct a working version of a trivia game client on iOS, that contacts a server (written in C) on Linux(Ubuntu on Linux server hosted by Amazon).
The client program has been able to successfully contact the server over a TCP connection and have it's message processed, with the server returning a result such as finding a match from MYSQL database.
I am now completely stuck when it comes to implementing an encrypted/secure connection to send information to this custom server script. I began reading about SSL, and using certificate-key authentication/authorization and establishing this connection from an iOS app by using the key from the device's keychain assuming its the proper key. This lead to reading about TSL. I get the idea of everything but since I have this idea of trying to implement a custom server to handle information sent in, I haven't understood how to implement a certificate-key handshake for connections coming in on this specific port that the custom server script listens to.
- Am I completely in the wrong direction thinking that I write the code to authenticate a server to a requesting user, within this script itself?
- Would a proper direction be to: Have the server running under a specific linux user that has predefined abilities and restrictions so that nearly all that is allowed is running this script and contacting the MYSQL database? And then somehow the certificate is applied to just that user which runs the server that listens on the port designated for clients?
- Am I completely misunderstanding how certificates-keys are to be applied and used when a client is attempting to connect to a given IP Address and Port Number over a TCP connection. For instance, would the iOS client attempt to contact the socket, and it would attempt verification with the main linux computer instance on amazon, and not the actual server script bound and listening to that same port, regardless.
Here is the linux server which uses fork() to create a new process on incoming connections:
Main function which uses fork
<span class="kwd">int</span><span class="pln"> main</span><span class="pun">(</span><span class="pln"> </span><span class="kwd">int</span><span class="pln"> argc</span><span class="pun">,</span><span class="pln"> </span><span class="kwd">char</span><span class="pln"> </span><span class="pun">*</span><span class="pln">argv</span><span class="pun">[]</span><span class="pln"> </span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln"> </span><span class="kwd">int</span><span class="pln"> sockfd</span><span class="pun">,</span><span class="pln"> newsockfd</span><span class="pun">,</span><span class="pln"> portno</span><span class="pun">,</span><span class="pln"> clilen</span><span class="pun">;</span><span class="pln"> </span><span class="kwd">char</span><span class="pln"> buffer</span><span class="pun">[</span><span class="lit">256</span><span class="pun">];</span><span class="pln"> </span><span class="kwd">struct</span><span class="pln"> sockaddr_in serv_addr</span><span class="pun">,</span><span class="pln"> cli_addr</span><span class="pun">;</span><span class="pln"> </span><span class="kwd">int</span><span class="pln"> n</span><span class="pun">,</span><span class="pln"> pid</span><span class="pun">;</span><span class="pln"> </span><span class="com">/* First call to socket() function */</span><span class="pln"> sockfd </span><span class="pun">=</span><span class="pln"> socket</span><span class="pun">(</span><span class="pln">AF_INET</span><span class="pun">,</span><span class="pln"> SOCK_STREAM</span><span class="pun">,</span><span class="pln"> </span><span class="lit">0</span><span class="pun">);</span><span class="pln"> </span><span class="kwd">if</span><span class="pln"> </span><span class="pun">(</span><span class="pln">sockfd </span><span class="pun"><</span><span class="pln"> </span><span class="lit">0</span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln"> perror</span><span class="pun">(</span><span class="str">"ERROR opening socket"</span><span class="pun">);</span><span class="pln"> </span><span class="kwd">exit</span><span class="pun">(</span><span class="lit">1</span><span class="pun">);</span><span class="pln"> </span><span class="pun">}</span><span class="pln"> </span><span class="com">/* Initialize socket structure */</span><span class="pln"> bzero</span><span class="pun">((</span><span class="kwd">char</span><span class="pln"> </span><span class="pun">*)</span><span class="pln"> </span><span class="pun">&</span><span class="pln">serv_addr</span><span class="pun">,</span><span class="pln"> </span><span class="kwd">sizeof</span><span class="pun">(</span><span class="pln">serv_addr</span><span class="pun">));</span><span class="pln"> portno </span><span class="pun">=</span><span class="pln"> </span><span class="lit">8888</span><span class="pun">;</span><span class="pln"> serv_addr</span><span class="pun">.</span><span class="pln">sin_family </span><span class="pun">=</span><span class="pln"> AF_INET</span><span class="pun">;</span><span class="pln"> serv_addr</span><span class="pun">.</span><span class="pln">sin_addr</span><span class="pun">.</span><span class="pln">s_addr </span><span class="pun">=</span><span class="pln"> INADDR_ANY</span><span class="pun">;</span><span class="pln"> serv_addr</span><span class="pun">.</span><span class="pln">sin_port </span><span class="pun">=</span><span class="pln"> htons</span><span class="pun">(</span><span class="pln">portno</span><span class="pun">);</span><span class="pln"> </span><span class="com">/* Now bind the host address using bind() call.*/</span><span class="pln"> </span><span class="kwd">if</span><span class="pln"> </span><span class="pun">(</span><span class="pln">bind</span><span class="pun">(</span><span class="pln">sockfd</span><span class="pun">,</span><span class="pln"> </span><span class="pun">(</span><span class="kwd">struct</span><span class="pln"> sockaddr </span><span class="pun">*)</span><span class="pln"> </span><span class="pun">&</span><span class="pln">serv_addr</span><span class="pun">,</span><span class="pln"> </span><span class="kwd">sizeof</span><span class="pun">(</span><span class="pln">serv_addr</span><span class="pun">))</span><span class="pln"> </span><span class="pun"><</span><span class="pln"> </span><span class="lit">0</span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln"> perror</span><span class="pun">(</span><span class="str">"ERROR on binding"</span><span class="pun">);</span><span class="pln"> </span><span class="kwd">exit</span><span class="pun">(</span><span class="lit">1</span><span class="pun">);</span><span class="pln"> </span><span class="pun">}</span><span class="pln"> </span><span class="com">/* Now start listening for the clients, here * process will go in sleep mode and will wait * for the incoming connection */</span><span class="pln"> listen</span><span class="pun">(</span><span class="pln">sockfd</span><span class="pun">,</span><span class="lit">5</span><span class="pun">);</span><span class="pln"> clilen </span><span class="pun">=</span><span class="pln"> </span><span class="kwd">sizeof</span><span class="pun">(</span><span class="pln">cli_addr</span><span class="pun">);</span><span class="pln"> </span><span class="kwd">while</span><span class="pln"> </span><span class="pun">((</span><span class="pln">newsockfd </span><span class="pun">=</span><span class="pln"> accept</span><span class="pun">(</span><span class="pln">sockfd</span><span class="pun">,</span><span class="pln"> </span><span class="pun">(</span><span class="kwd">struct</span><span class="pln"> sockaddr </span><span class="pun">*)</span><span class="pln"> </span><span class="pun">&</span><span class="pln">cli_addr</span><span class="pun">,</span><span class="pln"> </span><span class="pun">&</span><span class="pln">clilen</span><span class="pun">)))</span><span class="pln"> </span><span class="pun">{</span><span class="pln"> </span><span class="com">// Here is where the connnection is accepted and a new socket is made from it</span><span class="pln"> </span><span class="com">// Then test cases to decide whether or not to fork the socket. (Test if it's empty.)</span><span class="pln"> </span><span class="kwd">if</span><span class="pln"> </span><span class="pun">(</span><span class="pln">newsockfd </span><span class="pun"><</span><span class="pln"> </span><span class="lit">0</span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln"> perror</span><span class="pun">(</span><span class="str">"ERROR on accept"</span><span class="pun">);</span><span class="pln"> </span><span class="kwd">exit</span><span class="pun">(</span><span class="lit">1</span><span class="pun">);</span><span class="pln"> </span><span class="pun">}</span><span class="pln"> printf</span><span class="pun">(</span><span class="str">"IP Address: %lu"</span><span class="pun">,</span><span class="pln"> cli_addr</span><span class="pun">.</span><span class="pln">sin_addr</span><span class="pun">.</span><span class="pln">s_addr</span><span class="pun">);</span><span class="pln"> printf</span><span class="pun">(</span><span class="str">" Port: %hu "</span><span class="pun">,</span><span class="pln"> cli_addr</span><span class="pun">.</span><span class="pln">sin_port</span><span class="pun">);</span><span class="pln"> </span><span class="com">// If the above new socket returns successful, the following is executed</span><span class="pln"> </span><span class="com">// The fork function creates a new process.</span><span class="pln"> </span><span class="com">/* Create child process */</span><span class="pln"> pid </span><span class="pun">=</span><span class="pln"> fork</span><span class="pun">();</span><span class="pln"> </span><span class="kwd">if</span><span class="pln"> </span><span class="pun">(</span><span class="pln">pid </span><span class="pun"><</span><span class="pln"> </span><span class="lit">0</span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln"> perror</span><span class="pun">(</span><span class="str">"ERROR on fork"</span><span class="pun">);</span><span class="pln"> </span><span class="kwd">exit</span><span class="pun">(</span><span class="lit">1</span><span class="pun">);</span><span class="pln"> </span><span class="pun">}</span><span class="pln"> </span><span class="com">// If the fork is created succesfully, pass the integer for the new socket to the fork's processing function.</span><span class="pln"> </span><span class="kwd">if</span><span class="pln"> </span><span class="pun">(</span><span class="pln">pid </span><span class="pun">==</span><span class="pln"> </span><span class="lit">0</span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln"> </span><span class="com">/* This is the client process */</span><span class="pln"> </span><span class="com">// Close the original socket</span><span class="pln"> close</span><span class="pun">(</span><span class="pln">sockfd</span><span class="pun">);</span><span class="pln"> </span><span class="com">// Pass the copy of the socket ID to the new process</span><span class="pln"> doprocessing</span><span class="pun">(</span><span class="pln">newsockfd</span><span class="pun">);</span><span class="pln"> </span><span class="com">// Then exit since the new process function will handle the already established socket connection</span><span class="pln"> </span><span class="kwd">exit</span><span class="pun">(</span><span class="lit">0</span><span class="pun">);</span><span class="pln"> </span><span class="pun">}</span><span class="pln"> </span><span class="kwd">else</span><span class="pln"> </span><span class="pun">{</span><span class="pln"> close</span><span class="pun">(</span><span class="pln">newsockfd</span><span class="pun">);</span><span class="pln"> </span><span class="pun">}</span><span class="pln"> </span><span class="pun">}</span><span class="pln"> </span><span class="pun">}</span><span class="pln"> </span>
The doprocessing() function
<span class="kwd">void</span><span class="pln"> doprocessing </span><span class="pun">(</span><span class="kwd">int</span><span class="pln"> sock</span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln"> </span><span class="kwd">int</span><span class="pln"> read_size</span><span class="pun">;</span><span class="pln"> </span><span class="kwd">char</span><span class="pln"> client_message</span><span class="pun">[</span><span class="lit">2000</span><span class="pun">];</span><span class="pln"> </span><span class="kwd">char</span><span class="pln"> response_message</span><span class="pun">[</span><span class="lit">100</span><span class="pun">];</span><span class="pln"> </span><span class="kwd">char</span><span class="pln"> intArray</span><span class="pun">[</span><span class="lit">10</span><span class="pun">]</span><span class="pln"> </span><span class="pun">=</span><span class="pln"> </span><span class="pun">{</span><span class="lit">0</span><span class="pun">};</span><span class="pln"> </span><span class="kwd">while</span><span class="pun">(</span><span class="pln"> </span><span class="pun">(</span><span class="pln">read_size </span><span class="pun">=</span><span class="pln"> recv</span><span class="pun">(</span><span class="pln">sock </span><span class="pun">,</span><span class="pln"> client_message </span><span class="pun">,</span><span class="pln"> </span><span class="lit">2000</span><span class="pln"> </span><span class="pun">,</span><span class="pln"> </span><span class="lit">0</span><span class="pun">))</span><span class="pln"> </span><span class="pun">></span><span class="pln"> </span><span class="lit">0</span><span class="pln"> </span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln"> </span><span class="com">//DO CUSTOM SERVER STUFF HERE DEPENDING ON MESSAGE RECEIVED</span><span class="pln"> </span><span class="pun">}</span><span class="pln"> </span><span class="kwd">else</span><span class="pln"> </span><span class="pun">{</span><span class="pln"> printf</span><span class="pun">(</span><span class="str">"Match didnt work"</span><span class="pun">);</span><span class="pln"> </span><span class="pun">}</span><span class="pln"> </span><span class="kwd">if</span><span class="pun">(</span><span class="pln">read_size </span><span class="pun">==</span><span class="pln"> </span><span class="lit">0</span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln"> puts</span><span class="pun">(</span><span class="str">"Client disconnected"</span><span class="pun">);</span><span class="pln"> fflush</span><span class="pun">(</span><span class="pln">stdout</span><span class="pun">);</span><span class="pln"> </span><span class="pun">}</span><span class="pln"> </span><span class="kwd">else</span><span class="pln"> </span><span class="kwd">if</span><span class="pun">(</span><span class="pln">read_size </span><span class="pun">==</span><span class="pln"> </span><span class="pun">-</span><span class="lit">1</span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln"> perror</span><span class="pun">(</span><span class="str">"recv failed"</span><span class="pun">);</span><span class="pln"> </span><span class="pun">}</span>
I didn't include all of the code that comes after the server received a message and decides which functions to call to contact databases, etc... but I think I should note all of these functions are listed in the same script. I am currently doing this because I am just attempting to get everything running so I can see and understand the flow of information.
The main question is Where would I start implementing code that takes an incoming connection and goes through all of the SSL handshake steps to authenticate/authorize this server...
I have been reading everything I could find on the internet and the only thing I seem to come across is how to setup the certificates for a server like Apache, etc... and I feel like I don't understand how certificates are even implemented or if this is even a reasonable approach to writing a server script that can handle an SSL/TSL TCP connection, and process that data for queries to a MYSQL database that are on the same machine the server script is running on. Am I going about things the right way?
Thank you so much for any help! It is sincerely appreciated.
Categories
- All Categories
- 60 LFX Mentorship
- 113 LFX Mentorship: Linux Kernel
- 618 Linux Foundation IT Professional Programs
- 321 Cloud Engineer IT Professional Program
- 142 Advanced Cloud Engineer IT Professional Program
- 55 DevOps Engineer IT Professional Program
- 68 Cloud Native Developer IT Professional Program
- 6 Express Training Courses
- 6 Express Courses - Discussion Forum
- 2.3K Training Courses
- 19 LFC110 Class Forum - Discontinued
- 9 LFC131 Class Forum
- 31 LFD102 Class Forum
- 176 LFD103 Class Forum
- 22 LFD121 Class Forum
- 2 LFD137 Class Forum
- 61 LFD201 Class Forum
- 2 LFD210 Class Forum
- 1 LFD210-CN Class Forum
- 1 LFD213 Class Forum - Discontinued
- 128 LFD232 Class Forum - Discontinued
- LFD237 Class Forum
- 23 LFD254 Class Forum
- 653 LFD259 Class Forum
- 108 LFD272 Class Forum
- 1 LFD272-JP クラス フォーラム
- 4 LFD273 Class Forum
- 2 LFS145 Class Forum
- 28 LFS200 Class Forum
- 740 LFS201 Class Forum - Discontinued
- 1 LFS201-JP クラス フォーラム
- 12 LFS203 Class Forum
- 92 LFS207 Class Forum
- 301 LFS211 Class Forum
- 54 LFS216 Class Forum
- 47 LFS241 Class Forum
- 41 LFS242 Class Forum
- 37 LFS243 Class Forum
- 12 LFS244 Class Forum
- 41 LFS250 Class Forum
- 1 LFS250-JP クラス フォーラム
- LFS251 Class Forum
- 143 LFS253 Class Forum
- LFS254 Class Forum
- LFS255 Class Forum
- LFS256 Class Forum
- LFS257 Class Forum
- 1.2K LFS258 Class Forum
- 10 LFS258-JP クラス フォーラム
- 106 LFS260 Class Forum
- 145 LFS261 Class Forum
- 39 LFS262 Class Forum
- 83 LFS263 Class Forum - Discontinued
- 15 LFS264 Class Forum - Discontinued
- 11 LFS266 Class Forum - Discontinued
- 20 LFS267 Class Forum
- 18 LFS268 Class Forum
- 26 LFS269 Class Forum
- 204 LFS272 Class Forum
- 1 LFS272-JP クラス フォーラム
- LFS274 Class Forum
- 3 LFS281 Class Forum
- 249 LFW211 Class Forum
- 177 LFW212 Class Forum
- 9 SKF100 Class Forum
- SKF200 Class Forum
- 907 Hardware
- 220 Drivers
- 74 I/O Devices
- 44 Monitors
- 116 Multimedia
- 210 Networking
- 102 Printers & Scanners
- 86 Storage
- 764 Linux Distributions
- 88 Debian
- 66 Fedora
- 15 Linux Mint
- 13 Mageia
- 24 openSUSE
- 143 Red Hat Enterprise
- 33 Slackware
- 13 SUSE Enterprise
- 357 Ubuntu
- 482 Linux System Administration
- 40 Cloud Computing
- 70 Command Line/Scripting
- Github systems admin projects
- 95 Linux Security
- 80 Network Management
- 108 System Management
- 51 Web Management
- 72 Mobile Computing
- 25 Android
- 32 Development
- 1.2K New to Linux
- 1.1K Getting Started with Linux
- 545 Off Topic
- 132 Introductions
- 223 Small Talk
- 22 Study Material
- 831 Programming and Development
- 282 Kernel Development
- 515 Software Development
- 974 Software
- 260 Applications
- 185 Command Line
- 3 Compiling/Installing
- 119 Games
- 318 Installation
- 65 All In Program
- 65 All In Forum
Upcoming Training
-
August 20, 2018
Kubernetes Administration (LFS458)
-
August 20, 2018
Linux System Administration (LFS301)
-
August 27, 2018
Open Source Virtualization (LFS462)
-
August 27, 2018
Linux Kernel Debugging and Security (LFD440)