41–50 of 63 posts
I wanted to build a TeamViewer-type system using reverse tunnels so that I could access my possibly NAT'd or dynamic IP machines from each other in a simple way. The typical use would be SSH control, copying files each way, VNC. I came up with something where each machine connects to a an always-on server with a domain name, and offers a reverse tunnel I can use to SSH down, but it occurs to me that there might be a…
I wanted to build a TeamViewer-type system using reverse tunnels so that I could access my possibly NAT'd or dynamic IP machines from each other in a simple way. The typical use would be SSH control, copying files each way, VNC. I came up with something where each machine connects to a an always-on server with a domain name, and offers a reverse tunnel I can use to SSH down, but it occurs to me that there might be a…
Earlier quoted context omitted.
That’s pretty simple to do with Linux too… Just install ufw and set it to deny by default, then open the SSH port to only your IP. No need to go through AWS for that.
Didn't know about ufw, but I'm not on the same network as the RPI and don't have a static IP. And the RPI was already uploading data to an AWS instance.
Earlier quoted context omitted.
Have a look at https://docs.aws.amazon.com/systems-manager/latest/userguide... - in a lot of cases removes the need for a bastion and SSH keys at all
I have been looking into SSM recently and I was a little confused by the setup instructions but after seeing your comment I read them again and I think I understand more now. I was trying to see how SSM could be used to eliminate the need for engineers to have SSH keys set up with instances. > Who should use Session Manager? > ... > Users who want to connect to an instance with just one click from the browser or AWS…
The fact is that ssh tunnels are bound to an interface on one side and the other can be any (reachable) host:port. So if example.com:1234 isn’t reachable from your host network, you can do a local port forward to example.com:1234 from an intermediary host that can reach example.com:1234
For most use cases, you should also add a local bind, "-Llocalhost:5900:localhost:5900" or else everyone at the coffee shop will be able to access your insecure Vnc server
The manual page says, "By default, the local port is bound in accordance with the GatewayPorts setting."
I don't see GatewayPorts in any of the config files, so the binary (at least mine) is probably built to have this off by default. Which seems like a sensible setting.
EDIT: It can't hurt to be sure, though. Especially if you're running ssh commands on different computers or writing a script that runs ssh.
This uses the escape mechanism. For help on that, hit return, type "~?" and hit return again.
From there you will see that "~#" will list them. And "~C" takes you to a line-oriented command prompt where you can add them.
For example, type return "~C", then at the prompt type "-L1234:localhost:22". Then in another window, type "telnet localhost 1234". Then back in the ssh window, type return "~#" and you will see the tunnel being used.
Another trick: if you don't need a shell and only want to forward ports, run "ssh -N" instead of "ssh".
I wanted to build a TeamViewer-type system using reverse tunnels so that I could access my possibly NAT'd or dynamic IP machines from each other in a simple way. The typical use would be SSH control, copying files each way, VNC. I came up with something where each machine connects to a an always-on server with a domain name, and offers a reverse tunnel I can use to SSH down, but it occurs to me that there might be a…
You should check https://sshreach.me - zero-configuration, remote-controlled secure tunnels to your computers. I am the author of the service.
Some things to note:
- The sshReach.me logo in the topbar links to https://sshreach.me/init/default/index.html rather than https://sshreach.me. Expected the latter to have a clean URL to bookmark.
- At the very bottom of https://sshreach.me/init/default/index.html, the links {debian,arch,mint,...} link to the distro homepages. I expected links going to distro-specific guides on how to set these distros up to use our service.
- The Yocto project is quite popular for building embedded devices. It would probably push your service, if you would provide yocto recipes which make the created systems maintain reverse ssh tunnels to your service.
You can also change/add them after the ssh session has started. This uses the escape mechanism. For help on that, hit return, type "~?" and hit return again. From there you will see that "~#" will list them. And "~C" takes you to a line-oriented command prompt where you can add them. For example, type return "~C", then at the prompt type "-L1234:localhost:22". Then in another window, type "telnet localhost 1234". The…