Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

labs.iximiuz.com

Post reply on HN
Print view View original

31–40 of 83 posts

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#31

Post by lfx »

Oxodao wrote: post #18
lfx wrote: post #7

Earlier quoted context omitted.

I do this all the time, I have a skill/gem with instructions on how I want to receive info, how to format and so on. Really helps to go fast to get the point.

Could you share it? I'd be interested to get idea to make my own

It goes like this: --- As an expert tutorial creator for experienced engineers, you take the input the user request and make interactive tutorial. Default style is technology, tech is mac and linux. Default style is 20mins, but you ask for the timeline. Also do not forget to provide the cost of technologies used. ---

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#32

Post by ranger_danger »

wbadart wrote: post #21

I never pass up an opportunity to recommend the Cyber Plumber's Handbook: https://github.com/opsdisk/the_cyber_plumbers_handbook Goes over similar content as TFA, in perhaps a little more depth. Indispensable sysadmin knowledge.

Not mentioning the ssh -w option in that book should be a crime.

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#33

Post by tangotaylor »

My favorite use of this is peer-to-peer transfer of Docker images. The Docker CLI only allows you to use registries authenticated with HTTPS but there's an exception where it allows HTTP transfers over localhost.

So, if you use SSH tunneling to forward a port from localhost to a remote, then Docker unwittingly pushes to a remote. This is super useful "off the grid" with robotics/embedded applications where you don't want to bother with a registry and a good Internet connection.

Example, docker pussh: https://github.com/psviderski/unregistry

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#34

Post by ranger_danger »

bheadmaster wrote: post #22

If you have many different remote devices behind NATs or firewalls, a cool trick to access them all via EC2 server (or such) is to setup Remote Forwarding via UNIX socket on the server side, to devices' port 22. Preferably, UNIX socket filenames should start with a common prefix, so an SSH config can be written that will use ssh+socat in a ProxyCommand to establish the connection. It's amazing how lightweight this me…

Do you have more info on this method? How is the remote forwarding actually done?

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#35

Post by Kampfschnitzel »

tangotaylor wrote: post #33

My favorite use of this is peer-to-peer transfer of Docker images. The Docker CLI only allows you to use registries authenticated with HTTPS but there's an exception where it allows HTTP transfers over localhost. So, if you use SSH tunneling to forward a port from localhost to a remote, then Docker unwittingly pushes to a remote. This is super useful "off the grid" with robotics/embedded applications where you don't…

iirc there's a setting to allow docker to trust and use http registries

i set it up a few years ago for my homelab

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#36

Post by mldbk »

ranger_danger wrote: post #34
bheadmaster wrote: post #22

If you have many different remote devices behind NATs or firewalls, a cool trick to access them all via EC2 server (or such) is to setup Remote Forwarding via UNIX socket on the server side, to devices' port 22. Preferably, UNIX socket filenames should start with a common prefix, so an SSH config can be written that will use ssh+socat in a ProxyCommand to establish the connection. It's amazing how lightweight this me…

Do you have more info on this method? How is the remote forwarding actually done?

[dead]

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#37

Post by QGQBGdeZREunxLe »

tangotaylor wrote: post #33

My favorite use of this is peer-to-peer transfer of Docker images. The Docker CLI only allows you to use registries authenticated with HTTPS but there's an exception where it allows HTTP transfers over localhost. So, if you use SSH tunneling to forward a port from localhost to a remote, then Docker unwittingly pushes to a remote. This is super useful "off the grid" with robotics/embedded applications where you don't…

This is really useful as you don't have to add an entry under insecure-registries for local registries that don't have valid certificates.

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#38

Post by m348e912 »

chasil wrote: post #4

The article mentions bastions, but no jumphosting? ssh -J user1@bastion1,user2@bastion2 targetuser@targethost Edit: Jumphosting was introduced in OpenSSH 7.3 2016-08-01. https://www.openssh.org/releasenotes.html

>ssh -J user1@bastion1,user2@bastion2 targetuser@targethost

Are you using SSH key auth or password authenticating three times when you do this?

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#39

Post by bitlad »

QGQBGdeZREunxLe wrote: post #37
tangotaylor wrote: post #33

My favorite use of this is peer-to-peer transfer of Docker images. The Docker CLI only allows you to use registries authenticated with HTTPS but there's an exception where it allows HTTP transfers over localhost. So, if you use SSH tunneling to forward a port from localhost to a remote, then Docker unwittingly pushes to a remote. This is super useful "off the grid" with robotics/embedded applications where you don't…

This is really useful as you don't have to add an entry under insecure-registries for local registries that don't have valid certificates.

You might as well handover the images to hackers.

Re: A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

#40

Post by mmh0000 »

tangotaylor wrote: post #33

My favorite use of this is peer-to-peer transfer of Docker images. The Docker CLI only allows you to use registries authenticated with HTTPS but there's an exception where it allows HTTP transfers over localhost. So, if you use SSH tunneling to forward a port from localhost to a remote, then Docker unwittingly pushes to a remote. This is super useful "off the grid" with robotics/embedded applications where you don't…

That's not quite true, you just need to add the `insecure-registries`[1] option with a list of either IP (or ip ranges) or hostnames that you want to allow without TLS.

```/etc/docker/daemon.json

  {
    "insecure-registries": ["10.100.0.0/24", "registry.yourmom.example.com:5000"]
  }
```

[1] https://docs.docker.com/reference/cli/dockerd/#insecure-regi...

Post reply on HN