Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH into private machines from anywhere using Cloudflare Tunnel

orth.uk

Post reply on HN
Print view View original

131–140 of 197 posts

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#131

Post by jgrahamc »

anderspitman wrote: post #125
jgrahamc wrote: post #95

Earlier quoted context omitted.

I am literally Cloudflare's CTO. I'm pretty sure I know that using Cloudflare Tunnel for SSH isn't a violation of our service.

Hold up. I follow this space closely (I maintain the list of tunneling tools linked in OP). Everybody I've communicated with has been operating under the assumption that section 2.8 applies to Cloudflare Tunnel. See for example my post on another thread yesterday [0]. Are you saying this isn't the case? Is it even possible to use Tunnel without going through the CDN? [0]: https://news.ycombinator.com/item?id=30259902

What I'm saying is we specifically allow people to use SSH with Cloudflare for Teams: https://developers.cloudflare.com/cloudflare-one/tutorials/s...

The original comment above implied that using SSH with Cloudflare Tunnel was somehow forbidden.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#132

Post by linsomniac »

I set up something similar using ZeroTier "public" networks and the libzt Python userspace library.

My use-case was to allow bitbucket hosted instances to connect to private instances in my infrastructure to push code to as part of the build pipeline. They way they are running Docker at bitbucket, you can't run the normal zerotier processes (IIRC, it wasn't allowed to create a tun/tap device).

The zerotier public networks are networks that anyone can join given the network ID, without requiring an admin to authorize them.

I wrote a python-based "ztproxy" [1] which you can call from SSH as a ProxyCommand like: `ProxyCommand /usr/bin/python3 /path/to/ztproxy /tmp 1234567890abcdef 9994 10.3.2.1 22`. On top of that I had SSH public key authentication of both the remote host and the local user, so even if the network ID was exposed, it wouldn't have been wide open. I also had ZeroTier network level rules that only allowed the SSH traffic.

[1]: https://github.com/linsomniac/ztproxy

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#133

Post by qbasic_forever »

jdrc wrote: post #9

Can we stop posting stuff that makes even more people give the keys of their house to the BigCorp cartel?

What are you giving Cloudflare here? You're running a tunnel daemon and piping a network process to it. There's no exchange of for example your private SSH keys.

If anything this is letting people more easily self host their own version of 'BigCorp cartel' apps like mail, code hosting, etc.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#135

Post by yewenjie »

How do I achieve the following related task with minimal effort?

I have a domain and VPS. I want to expose a local dev server running on my laptop to something like mydomain.xyz/something temporarily. I want to host it myself and would prefer open-source tools.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#136

Post by anderspitman »

jgrahamc wrote: post #131
anderspitman wrote: post #125

Earlier quoted context omitted.

Hold up. I follow this space closely (I maintain the list of tunneling tools linked in OP). Everybody I've communicated with has been operating under the assumption that section 2.8 applies to Cloudflare Tunnel. See for example my post on another thread yesterday [0]. Are you saying this isn't the case? Is it even possible to use Tunnel without going through the CDN? [0]: https://news.ycombinator.com/item?id=30259902

What I'm saying is we specifically allow people to use SSH with Cloudflare for Teams: https://developers.cloudflare.com/cloudflare-one/tutorials/s... The original comment above implied that using SSH with Cloudflare Tunnel was somehow forbidden.

Ah ok I misread your comment as implying the CDN ToS doesn't apply to Tunnel. It doesn't if you aren't using it (ie SSH), in which case only the Tunnel ToS applies, but otherwise both apply.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#137

Post by anderspitman »

yewenjie wrote: post #135

How do I achieve the following related task with minimal effort? I have a domain and VPS. I want to expose a local dev server running on my laptop to something like mydomain.xyz/something temporarily. I want to host it myself and would prefer open-source tools.

Minimal effort is use Cloudflare Tunnel (it supports more than SSH, including HTTPS). For self-hosted alternatives check the list linked in OP.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#138

Post by Datagenerator »

yewenjie wrote: post #135

How do I achieve the following related task with minimal effort? I have a domain and VPS. I want to expose a local dev server running on my laptop to something like mydomain.xyz/something temporarily. I want to host it myself and would prefer open-source tools.

Lookup SirTunnel and Boringproxy on GitHub

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#139

Post by drawfloat »

hotpotamus wrote: post #47
mro_name wrote: post #40

wasn't that the idea of ssh to begin with?

You mean, like just login to a server without going through layers of cloud providers? How would that work? For real, I can't imagine running a straight port 22 ssh service on the modern internet, but I'm usually happy just moving it to an unprivileged port for obscurity on personal equipment (plus some other common sense hardening of course). For work stuff, I'd feel naked without some sort of VPN and it seems that'…

With passwords disabled and just using key authentication, is there a big risk of just doing a straight port 22 ssh?

Genuine question, my knowledge of server security is low-to-middle.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#140

Post by awill »

square_usual wrote: post #50
throw3838 wrote: post #46

You can get virtual server for $4/month. Installing proprietary software and registering to some service, that may "upgrade" to premium tier anytime, is pretty off-putting.

If they upgrade to premium tier, set up your virtual server then. Your total cost, $0 for the duration it's free + $4 * the rest is still lower than $4 * lifetime, and the cost for switching is only going to be marginal.

I get the thought, you can build something now that is guaranteed to have a fixed cost, or you can risk going with a free product that might surprise you, causing you to rush to replace the solution with a tight deadline.

Just look at all the people panicking with the free Google Workspace shutdown.

Post reply on HN