Live data from Hacker News

SSH into private machines from anywhere using Cloudflare Tunnel

orth.uk

71–80 of 197 posts

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#71
post #39

If you like this, you’re gonna love Tailscale https://tailscale.com/

I love Tailscale, but it’s not really designed for public tunnels. You can do it, but you typically need to provision some kind of proxy with a static IP (most likely cloud based) to handle your public stuff.

what do you mean by public channels? if I was trying to ssh into my machines it works wonderfully for dns resolution.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#72
post #14

Unfortunately the cloudflared software, while the source is available on GitHub, and there are pull requests open and accepted for it, is not under an open source license, and the license it is under does not allow modifications, so any modifications (including the aformentioned pull requests) are contrary to the license and thus copyright law and thus illegal. The issue I filed about this is still waiting for action…

No, pull requests are not illegal, at least when done on Github, because by posting code on Github (that you are allowed to post) you grant Github and its users certain rights: https://docs.github.com/en/github/site-policy/github-terms-o... > By setting your repositories to be viewed publicly, you agree to allow others to view and "fork" your repositories (this means that others may make their own copies of Content f…

In this specific case you might be correct but in the general case this is not true. The uploader agreeing to something does not affect the rights of other authors than the uploader.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#73

Personally I’m happier to use wireguard to access my network. I don’t know when I’d ever want a pure SSH tunnelling solution.

So easy to set up too with docker. You can even generate a QR code to easily set up a mobile device. You do need a domain name, DDNS, or a static IP and the ability to port forward from the router

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#74
post #59

You can get virtual server for $4/month. Installing proprietary software and registering to some service, that may "upgrade" to premium tier anytime, is pretty off-putting.

Why use a virtual server if you want to connect to your home network?

My home network has a dynamic IP. I'm using a home-baked dynamic DNS thingie, but a virtual server with a fixed IP could work too. Would update for the new IP much faster now that I think about it.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#75
post #48

Earlier quoted context omitted.

Breaking a contract is not illegal. Seems to be a common misconception.

Please explain? I've googled your sentiment and have found some links but not many answers. Breaking a contract is just as illegal (~ against the law) as breaking the law? This follows trivially from contract law being a part of law. More substantive: Both contracts and laws proscribe actions. One can find remedy for breaking either via the legal system. (Obviously the severity of punishment can differ several orders…

> This follows trivially from contract law being a part of law

That does not follow trivially. Contracts themselves are not articles of contract law.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#76

shameless self-promotion: https://sshreach.me We have a ssh reverse-forwarding based solution. And unlike the Cloudflare solution you don't need to "give the keys of your house" (as someone here commented) to reach your private machines. You can remotely open and close the tunnels through our web interface or our web API. Plus, we have web API-based automated deployment solution if you have many clients.

“Your server creates a forwarding ssh tunnel to one of our publicly visible forwarding servers” seems like a huge risk for somebody else to own these “forwarding servers”. Worse than giving keys to your house? I dunno.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#77
post #14

Unfortunately the cloudflared software, while the source is available on GitHub, and there are pull requests open and accepted for it, is not under an open source license, and the license it is under does not allow modifications, so any modifications (including the aformentioned pull requests) are contrary to the license and thus copyright law and thus illegal. The issue I filed about this is still waiting for action…

you may be interested on zSSH then. apache v2.

https://github.com/openziti-incubator

enables ssh without exposing sshd ports to the networks.

disclosure: founder of company who builds products on OpenZiti open source

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#78
post #38

Earlier quoted context omitted.

No, pull requests are not illegal, at least when done on Github, because by posting code on Github (that you are allowed to post) you grant Github and its users certain rights: https://docs.github.com/en/github/site-policy/github-terms-o... > By setting your repositories to be viewed publicly, you agree to allow others to view and "fork" your repositories (this means that others may make their own copies of Content f…

That license doesn't allow modifications, which is what pull requests are. The forking thing is only about making copies, not modifications.

Not a lawyer, but it seems like it could be implied-in-fact that you're allowing people to submit pull requests if you publish on GitHub. https://en.wikipedia.org/wiki/Implied-in-fact_contract

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#79
I'm under the impression that this is against CloudFlare's ToS, otherwise I'd probably be doing it myself.

See section 2.8 "Limitation on Serving Non-HTML Content." of their subscriber agreement:

use of the Services for serving video or a disproportionate percentage of pictures, audio files, or other non-HTML content is prohibited, unless purchased separately as part of a Paid Service or expressly allowed under our Supplemental Terms for a specific Service.

Last I checked, SSH is non-html content. I even opened a support ticket with their support, specifically asking about SSH and other traffic and this is what I received: So if no matter what service you use, Once you breach this rule it will be applied.

EDIT: Looks like the CloudFlare CTO has clarified things below that this usage does not in fact violate the ToS.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#80

> Each port is also limited to a single machine, so you'd have to choose a different port for a different machine. I would probably set up one gateway machine, and then from that machine log into other machines on the network; instead of exposing them all to the Internet. SSH allows you to chain logins thus: ssh -A -t user@public-gateway ssh -A -t user2@server-behind-dmz It's a lot less work to lock down one machine…

I use this alias in my .ssh/config to connect through a gateway machine:

    Host myserver
        User user
        ProxyCommand ssh -q public-server nc -q0 private-server 22
I can't remember what these flags actually do but they seem to get the job done
Post reply on HN