Show HN: Tunshell – Remote shell into ephemeral environments behind NAT/firewall
1–10 of 14 posts
Re: Show HN: Tunshell – Remote shell into ephemeral environments behind NAT/firewall
#2TL;DR: Reverse SSH using an helper along the way?
Re: Show HN: Tunshell – Remote shell into ephemeral environments behind NAT/firewall
#3Can this be used similar to tmate (https://github.com/tmate-io/tmate) to easily share a shell?
Why I asked for this is because tmate isn't really that secure. You have to trust the relay server.
Maybe tunshell can be combined with tmux directly to open a shared view.
Re: Show HN: Tunshell – Remote shell into ephemeral environments behind NAT/firewall
#4TL;DR: Reverse SSH using an helper along the way?
Yep, that's what I'm using pretty much every day.
Quote from their website:
> The use case for tunshell is predominantly quick, ad-hoc remote access to hosts which you may not have SSH access to, or even the ability to install an SSH daemon at all.
They mention GitHub Actions, BitBucket Pipelines, AWS Lambda and Google Cloud Serverless Functions as target usage areas for this tool.
Re: Show HN: Tunshell – Remote shell into ephemeral environments behind NAT/firewall
#5Like any good distributed system networking layer, this is botnet control plane.
Re: Show HN: Tunshell – Remote shell into ephemeral environments behind NAT/firewall
#6Dear God, grant us mere mortals DPI powers to block this and similar things, 'cause devs are often do not know what they are doing.
Re: Show HN: Tunshell – Remote shell into ephemeral environments behind NAT/firewall
#7Like any good distributed system networking layer, this is botnet control plane.
> Unsavory Use-cases
> Tunshell could also be used as an exploitation tool to gain unauthorized access to remote hosts. Personally, I hope that this tool is not misused for nefarious purposes. If it becomes apparent that tunshell is helping malicious actors go about their activities, the free service will be discontinued.
It seems the author already though about that. Well, don't we all here have the Security Mindset (TM)? [1]
[1] https://www.schneier.com/blog/archives/2008/03/the_security_...
Re: Show HN: Tunshell – Remote shell into ephemeral environments behind NAT/firewall
#8For accessing aws ec2 instances behind nat/fw add this lines ~/.ssh/config:
Host i-* mi-*
ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'"
UserKnownHostsFile /dev/null
StrictHostKeyChecking no
User ubuntu
LogLevel ERROR
DynamicForward 5060
Re: Show HN: Tunshell – Remote shell into ephemeral environments behind NAT/firewall
#9For accessing aws ec2 instances behind nat/fw add this lines ~/.ssh/config: Host i-* mi-* ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'" UserKnownHostsFile /dev/null StrictHostKeyChecking no User ubuntu LogLevel ERROR DynamicForward 5060 Usage: `ssh -i key.pem i-0xxxxxxxxxx`. Last config line can be used for optional proxy browsing.
[deleted]
Re: Show HN: Tunshell – Remote shell into ephemeral environments behind NAT/firewall
#10For accessing aws ec2 instances behind nat/fw add this lines ~/.ssh/config: Host i-* mi-* ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'" UserKnownHostsFile /dev/null StrictHostKeyChecking no User ubuntu LogLevel ERROR DynamicForward 5060 Usage: `ssh -i key.pem i-0xxxxxxxxxx`. Last config line can be used for optional proxy browsing.
This is a game changer. I have a bastion host in certain environments I never realized AWS has built in kit to achieve this sort of thing. I assume the key product here is SSM?