Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH Tunneling Explained

goteleport.com

Post reply on HN
Print view View original

11–20 of 63 posts

Re: SSH Tunneling Explained

#11

Post by john61 »

Y_Y wrote: post #2

I wanted to build a TeamViewer-type system using reverse tunnels so that I could access my possibly NAT'd or dynamic IP machines from each other in a simple way. The typical use would be SSH control, copying files each way, VNC. I came up with something where each machine connects to a an always-on server with a domain name, and offers a reverse tunnel I can use to SSH down, but it occurs to me that there might be a…

Not sure if it is exactly what you are looking for, but I use Remote Support Tool [1] as a free software TeamViewer replacement, and it works perfectly for me.

[1] https://github.com/OpenIndex/RemoteSupportTool

Re: SSH Tunneling Explained

#12

Post by reacharavindh »

At work, we have a handful of VPCs that we all work with. At the moment, we have a bastion host in every VPC. When something needs attention while on call, the engineer needs to first figure out which bastion host to ash into and then the actual work starts.

I was wondering if there is a better way to setup a central bastion host with RBAC such that the attack vector is also not centralised. Does anyone here have ideas?

Re: SSH Tunneling Explained

#14

Post by orwin »

reacharavindh wrote: post #12

At work, we have a handful of VPCs that we all work with. At the moment, we have a bastion host in every VPC. When something needs attention while on call, the engineer needs to first figure out which bastion host to ash into and then the actual work starts. I was wondering if there is a better way to setup a central bastion host with RBAC such that the attack vector is also not centralised. Does anyone here have ide…

At my previous work, we had that centralized bastion for the engineers (we were 5, and it might be harder with a bigger team). Only ssh with rsa, and the rsa key was generated with yubico tools, putting the private key inside our yubikey, and protecting access to said key with a password.

Then basic RBAC with sudoer file according rights depending on your role. The only root account was accessible through two locked up yubikeys, and the passwords of those were in a password manager owned by the architect and manager.

When i left, we were starting a V2 on this with internal LDAP for server/proxy access, first for us then for our clients.

Re: SSH Tunneling Explained

#15

Post by jsilence »

hamandcheese wrote: post #3
Y_Y wrote: post #2

I wanted to build a TeamViewer-type system using reverse tunnels so that I could access my possibly NAT'd or dynamic IP machines from each other in a simple way. The typical use would be SSH control, copying files each way, VNC. I came up with something where each machine connects to a an always-on server with a domain name, and offers a reverse tunnel I can use to SSH down, but it occurs to me that there might be a…

ZeroTier might be of interest.

Using Zerotier for this for quite a while now and can confirm it is working quite nicely.

TailScale might be an interesting alternative. Even more so as with headscale there is an Open Source server side implementation. Have not tested neither of those though.

Re: SSH Tunneling Explained

#16

Post by toiletduck »

reacharavindh wrote: post #12

At work, we have a handful of VPCs that we all work with. At the moment, we have a bastion host in every VPC. When something needs attention while on call, the engineer needs to first figure out which bastion host to ash into and then the actual work starts. I was wondering if there is a better way to setup a central bastion host with RBAC such that the attack vector is also not centralised. Does anyone here have ide…

Have a look at https://docs.aws.amazon.com/systems-manager/latest/userguide... - in a lot of cases removes the need for a bastion and SSH keys at all

Re: SSH Tunneling Explained

#19

Post by sschueller »

Y_Y wrote: post #2

I wanted to build a TeamViewer-type system using reverse tunnels so that I could access my possibly NAT'd or dynamic IP machines from each other in a simple way. The typical use would be SSH control, copying files each way, VNC. I came up with something where each machine connects to a an always-on server with a domain name, and offers a reverse tunnel I can use to SSH down, but it occurs to me that there might be a…

For remote shell support tmate is great. You can run your own server or use theirs.

https://tmate.io/

Post reply on HN