Div/doc/ssh_tunnelling.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
   2 <html><head>
   3
   4
   5
   6
   7
   8
   9
  10
  11
  12
  13   <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
  14
  15
  16
  17
  18
  19
  20
  21
  22
  23
  24   <title>ssh tunnelling</title></head>
  25
  26 <body bgcolor="#ffffff">
  27
  28
  29
  30
  31
  32 <script type="text/javascript"><!--
  33 google_ad_client = "pub-7705594074093958";
  34 google_ad_width = 728;
  35 google_ad_height = 90;
  36 google_ad_format = "728x90_as";
  37 google_ad_channel ="";
  38 google_color_border = "336699";
  39 google_color_bg = "FFFFFF";
  40 google_color_link = "0000FF";
  41 google_color_url = "008000";
  42 google_color_text = "000000";
  43 //--></script>
  44 <script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
  45 </script>
  46 <h2>ssh tunnelling</h2>
  47
  48
  49
  50
  51
  52 <p>ssh tunnelling is an excellent way to tunnel insecure protocols
  53 through a secure communication channel. In this example, I'll tunnel
  54 POP3 traffic using ssh. Traditional POP3 traffic, including username
  55 and password information, travels clear-text across the network.</p>
  56
  57
  58
  59
  60
  61 <p><a href="http://www.openssh.com/">OpenSSH</a> is used in the
  62 following examples.</p>
  63
  64
  65
  66
  67
  68 <p> To tunnel POP3 traffic using ssh:<br>
  69
  70
  71
  72
  73
  74 <br>
  75
  76
  77
  78
  79
  80 1. Make sure an ssh client is installed on your machine and an ssh
  81 server is installed on the POP3 server.<br>
  82
  83
  84
  85
  86
  87 <br>
  88
  89
  90
  91
  92
  93 2. Create a local ssh tunnel on your machine (port 1234 for this
  94 example) to the POP3 server's port 110. You will need to be the root
  95 user to bind to "privileged" ports (&lt; 1024).<br>
  96
  97
  98
  99
 100
 101 <span style="font-weight: bold;"># ssh -f -N -L 1234:localhost:110 user@<span style="font-style: italic;">POP3_server</span></span><br>
 102
 103
 104
 105
 106
 107 <br>
 108
 109
 110
 111
 112
 113 3. Test the tunnel.<br>
 114
 115
 116
 117
 118
 119 <span style="font-weight: bold;">$ telnet localhost 1234</span><br>
 120
 121
 122
 123
 124
 125 You should see the POP3 server's banner information.<br>
 126
 127
 128
 129
 130
 131 <br>
 132
 133
 134
 135
 136
 137 4. Configure your mail client to access your mail via POP3 using mail
 138 server <span style="font-style: italic;">localhost</span> and port
 139 1234.<br>
 140
 141
 142
 143
 144
 145 </p>
 146
 147
 148
 149
 150
 151 <h3><br>
 152
 153
 154
 155
 156
 157 "Reverse" ssh tunnel</h3>
 158
 159
 160
 161
 162
 163 It is possible to create a "reverse" ssh tunnel. The reverse tunnel
 164 will allow you to create an ssh tunnel from your work computer to your
 165 home computer, for example, and then login to your work machine from
 166 your home machine <span style="font-style: italic;">even if your work
 167 firewall does not permit ssh traffic initiated from your home machine!</span><br>
 168
 169
 170
 171
 172
 173 <br>
 174
 175
 176
 177
 178
 179 For this to work, an ssh server must be installed on your work and home
 180 computer, and ssh (TCP port 22) must be allowed outbound from your work
 181 computer to your home computer.<br>
 182
 183
 184
 185
 186
 187 <br>
 188
 189
 190
 191 $ ssh -R <span style="font-style: italic;">remote_port</span>:localhost:22
 192 <span style="font-style: italic;">your_home_computer</span><br>
 193
 194
 195
 196
 197
 198 <br>
 199
 200
 201
 202
 203
 204 ex. <span style="font-weight: bold;">$</span> <span style="font-weight: bold;">ssh -R 2048:localhost:22
 205 home.computer.com</span><br>
 206
 207
 208
 209
 210
 211 <br>
 212
 213
 214
 215
 216
 217 At home, you would then run <span style="font-weight: bold;">ssh -p
 218 2048 localhost</span> to log into your work computer via ssh.<br>
 219
 220
 221
 222
 223
 224 <br>
 225
 226
 227
 228
 229
 230 Here is a script I run every 5 minutes through the <span style="font-style: italic;">cron</span> facility on my work system to
 231 make sure the reverse ssh tunnel to my home system is up and running.
 232 It is useful in case <span style="font-style: italic;">my_home_system</span>
 233 is rebooted.<br>
 234
 235
 236 <br>
 237
 238
 239 2006-11-15 update:<br>
 240
 241
 242 <br>
 243
 244
 245 <span style="font-family: monospace;">#!/bin/sh</span><br style="font-family: monospace;">
 246
 247
 248 <br style="font-family: monospace;">
 249
 250
 251 <span style="font-family: monospace;"># $REMOTE_HOST is the name of the remote system</span><br style="font-family: monospace;">
 252
 253
 254 <span style="font-family: monospace;">REMOTE_HOST=my.home.system</span><br style="font-family: monospace;">
 255
 256
 257 <br style="font-family: monospace;">
 258
 259
 260 <span style="font-family: monospace;"># $REMOTE_PORT is the remote port number that will be used to tunnel</span><br style="font-family: monospace;">
 261
 262
 263 <span style="font-family: monospace;"># back to this system</span><br style="font-family: monospace;">
 264
 265
 266 <span style="font-family: monospace;">REMOTE_PORT=5000</span><br style="font-family: monospace;">
 267
 268
 269 <br style="font-family: monospace;">
 270
 271
 272 <span style="font-family: monospace;"># $COMMAND is the command used to create the reverse ssh tunnel</span><br style="font-family: monospace;">
 273
 274
 275 <span style="font-family: monospace;">COMMAND="ssh -q -N -R $REMOTE_PORT:localhost:22 $REMOTE_HOST"</span><br style="font-family: monospace;">
 276
 277
 278 <br style="font-family: monospace;">
 279
 280
 281 <span style="font-family: monospace;"># Is the tunnel up? Perform two tests:</span><br style="font-family: monospace;">
 282
 283
 284 <br style="font-family: monospace;">
 285
 286
 287 <span style="font-family: monospace;"># 1. Check for relevant process ($COMMAND)</span><br style="font-family: monospace;">
 288
 289
 290 <span style="font-family: monospace;">pgrep -f -x "$COMMAND" &gt; /dev/null 2&gt;&amp;1 || $COMMAND</span><br style="font-family: monospace;">
 291
 292
 293 <br style="font-family: monospace;">
 294
 295
 296 <span style="font-family: monospace;"># 2. Test tunnel by looking at "netstat" output on $REMOTE_HOST</span><br style="font-family: monospace;">
 297
 298
 299 <span style="font-family: monospace;">ssh $REMOTE_HOST netstat -an | egrep "tcp.*:$REMOTE_PORT.*LISTEN" \</span><br style="font-family: monospace;">
 300
 301
 302 <span style="font-family: monospace;">&nbsp;&nbsp; &gt; /dev/null 2&gt;&amp;1</span><br style="font-family: monospace;">
 303
 304
 305 <span style="font-family: monospace;">if [ $? -ne 0 ] ; then</span><br style="font-family: monospace;">
 306
 307
 308 <span style="font-family: monospace;">&nbsp;&nbsp; pkill -f -x "$COMMAND"</span><br style="font-family: monospace;">
 309
 310
 311 <span style="font-family: monospace;">&nbsp;&nbsp; $COMMAND</span><br style="font-family: monospace;">
 312
 313
 314 <span style="font-family: monospace;">fi</span><br>
 315
 316
 317
 318
 319
 320 <br>
 321
 322
 323
 324 2006-09-20 update using <span style="font-family: monospace;">pgrep</span>:<br>
 325
 326
 327
 328 <br>
 329
 330
 331
 332 <span style="font-family: monospace;">#!/bin/sh</span><br style="font-family: monospace;">
 333
 334
 335
 336 <br style="font-family: monospace;">
 337
 338
 339
 340 <span style="font-family: monospace;"># REMOTE_HOST is the name of the remote system</span><br style="font-family: monospace;">
 341
 342
 343
 344 <span style="font-family: monospace;">REMOTE_HOST=my.home.system</span><br style="font-family: monospace;">
 345
 346
 347
 348 <br style="font-family: monospace;">
 349
 350
 351
 352 <span style="font-family: monospace;"># $COMMAND is the command used to create the reverse ssh tunnel</span><br style="font-family: monospace;">
 353
 354
 355
 356 <span style="font-family: monospace;">COMMAND="ssh -N -R 7437:localhost:22 $REMOTE_HOST"</span><br style="font-family: monospace;">
 357
 358
 359
 360 <br style="font-family: monospace;">
 361
 362
 363
 364 <span style="font-family: monospace;"># Is the tunnel up?</span><br style="font-family: monospace;">
 365
 366
 367
 368 <span style="font-family: monospace;">pgrep -f -x "$COMMAND" &gt; /dev/null 2&gt;&amp;1 || $COMMAND</span><br>
 369
 370
 371
 372 <br>
 373
 374
 375
 376 Old script:<br>
 377
 378
 379
 380 <br style="font-family: monospace;">
 381
 382
 383
 384
 385
 386 <span style="font-family: monospace;">#!/bin/sh</span><br style="font-family: monospace;">
 387
 388
 389
 390
 391
 392 <br style="font-family: monospace;">
 393
 394
 395
 396
 397
 398 <span style="font-family: monospace;"># $COMMAND is the command used to
 399 create the reverse ssh tunnel</span><br style="font-family: monospace;">
 400
 401
 402
 403
 404
 405 <span style="font-family: monospace;">COMMAND='ssh -N -R
 406 31337:localhost:22 <span style="font-style: italic;">my_home_system</span>'</span><br style="font-family: monospace;">
 407
 408
 409
 410
 411
 412 <br style="font-family: monospace;">
 413
 414
 415
 416
 417
 418 <span style="font-family: monospace;"># Is the tunnel up?</span><br style="font-family: monospace;">
 419
 420
 421
 422
 423
 424 <span style="font-family: monospace;">CHECK_TUNNEL=`ps -eo args | grep
 425 "$COMMAND" | grep -v grep`</span><br style="font-family: monospace;">
 426
 427
 428
 429
 430
 431 <br style="font-family: monospace;">
 432
 433
 434
 435
 436
 437 <span style="font-family: monospace;"># If the tunnel is not up, create
 438 the tunnel</span><br style="font-family: monospace;">
 439
 440
 441
 442
 443
 444 <span style="font-family: monospace;">if [ -z "$CHECK_TUNNEL" ] ; then</span><br style="font-family: monospace;">
 445
 446
 447
 448
 449
 450 <span style="font-family: monospace;">&nbsp;&nbsp; $COMMAND</span><br style="font-family: monospace;">
 451
 452
 453
 454
 455
 456 <span style="font-family: monospace;">fi</span><br>
 457
 458
 459
 460
 461
 462 <br>
 463
 464
 465
 466
 467
 468 Links:<br>
 469
 470
 471
 472
 473
 474 <a href="http://www.akadia.com/services/ssh_port_forwarding.html">http://www.akadia.com/services/ssh_port_forwarding.html</a><a href="http://www.hackorama.com/pages/stunnell.shtml"><br>
 475
 476
 477
 478
 479
 480 http://www.hackorama.com/pages/stunnell.shtml</a><br>
 481
 482
 483
 484
 485
 486 <a href="http://proxytunnel.sourceforge.net/">http://proxytunnel.sourceforge.net/</a><br>
 487
 488
 489
 490
 491
 492 <a href="http://proxytunnel.sourceforge.net/papers/muppet-200204.html">http://proxytunnel.sourceforge.net/papers/muppet-200204.html</a><br>
 493
 494
 495
 496
 497
 498 <p>Back
 499 to <a href="http://www.brandonhutchinson.com/">brandonhutchinson.com</a>.
 500 </p>
 501
 502
 503
 504
 505
 506 <h6>Last modified: 2006/10/23</h6>
 507
 508
 509
 510
 511
 512 </body></html>