Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A visual guide to SSH tunnels

robotmoon.com

Post reply on HN
Print view View original

31–40 of 82 posts

Re: A visual guide to SSH tunnels

#31

Post by chrisandchris »

walrus01 wrote: post #30

One common use is to secure vnc, which has no crypto built into it. On the remote host, have the vnc server listen only on localhost:5901 This assumes everyone who can ssh to the server should be allowed access. On your workstation, form an ssh tunnel to that remote host and its port, and link it your own localhost:5901 Open your vnc client GUI and set it to open 127.0.0.1:5901, voila, vnc session. More fun things: s…

I am always amazed at what is possible with the linux command line, and it‘s something one can really fall in love with.

Re: A visual guide to SSH tunnels

#34

Post by labawi »

walrus01 wrote: post #30

One common use is to secure vnc, which has no crypto built into it. On the remote host, have the vnc server listen only on localhost:5901 This assumes everyone who can ssh to the server should be allowed access. On your workstation, form an ssh tunnel to that remote host and its port, and link it your own localhost:5901 Open your vnc client GUI and set it to open 127.0.0.1:5901, voila, vnc session. More fun things: s…

Note that it still exposes the connection to all local processes, on both hosts (except network-restricted services or with non-typical host-local firewall rules), though it should be fine, if you're using semi-reasonable passwords.

SSH supports unix domain socket forwarding and even cross unix/ip forwarding with a syntax like:

  ssh -L /path/to/sock:/path/to/sock
  ssh -L /path/to/sock:localhost:5901
  ssh -L 5091:/path/to/sock
Then you can have user-authenticated host and transit secure password-less VNC connections.

Unfortunately I haven't been able to convince tigervnc viewer to connect to a unix domain socket, so I don't have a fully scripted connection, but remmina and tigervnc server work fine.

Also, forwardings / connections fail if the socket already exists when the listening side starts up (often an unclosed leftover), so I rm them before starting the ssh connection / vnc server and it works reliably.

Re: A visual guide to SSH tunnels

#35

Post by labawi »

Why don't people use unix domain sockets for local connections? They are pretty much the same thing as local IP connections, except access rights apply as on files, so you're not exposing connections to pretty much all processes.

Domain sockets can be forwarded via ssh with the same -L and -R arguments, including cross unix/ip forwardings.

Re: A visual guide to SSH tunnels

#36

Post by labawi »

0x0 wrote: post #22
accrual wrote: post #20

Earlier quoted context omitted.

One can further tunnel SSH inside of TLS with Stunnel [0] to get through firewalls that block SSH but permit arbitrary TLS connections. Loading a website through this requires three layers of TCP but assuming the connection is good this should be okay. A couple reasons for a regular VPN: they can be made automatic and persistent so the tunnel is always ready for use, they can tunnel other protocols besides TCP, they…

Stunnel and ssh tunnels don't put TCP inside TCP so it shouldn't risk any TCP-in-TCP congestion issues?

Yes, and piecewise TCP is often even faster than point-to-point TCP, especially on flaky connections, or when the transient connections are on hosts with lower RTTs (outgoing gateway closer to destination). It will likely be faster than a UDP VPN.

It still does have overhead, so lower bandwidth. Also, TCP, SSH and/or TLS forwarding of UDP, IP or Ethernet can have issues with delays, re-transmits etc (TCP-in-TCP).

Re: A visual guide to SSH tunnels

#39

Post by macintux »

fooblat wrote: post #26

Great write up! One thing to add is that you can even open tunnels during an interactive session without disconnection. To do this, type the escape command sequence ~C (will not show) and it will drop you to the control prompt. You can then add tunnels. ssh> ssh> -L 8000:localhost:9000 Forwarding port.

I’ve been using ssh for 25+ years, I wrote a (in hindsight, pretty awful) article about it for Linux Journal, and I never knew this.

Re: A visual guide to SSH tunnels

#40

Post by chaosfox »

labawi wrote: post #35

Why don't people use unix domain sockets for local connections? They are pretty much the same thing as local IP connections, except access rights apply as on files, so you're not exposing connections to pretty much all processes. Domain sockets can be forwarded via ssh with the same -L and -R arguments, including cross unix/ip forwardings.

last time I tried ssh does not delete the socket file when the connection closes and complains the file already exists on a new connection.
Post reply on HN