This[1] is probably the best, easiest and most (visually) effective way to learn about SSH tunnels. [1] : https://unix.stackexchange.com/a/118650/289353
definitely more visual than this article...
A visual guide to SSH tunnels
61–70 of 82 posts
Re: A visual guide to SSH tunnels
#62One common use is to secure vnc, which has no crypto built into it. On the remote host, have the vnc server listen only on localhost:5901 This assumes everyone who can ssh to the server should be allowed access. On your workstation, form an ssh tunnel to that remote host and its port, and link it your own localhost:5901 Open your vnc client GUI and set it to open 127.0.0.1:5901, voila, vnc session. More fun things: s…
Note that it still exposes the connection to all local processes, on both hosts (except network-restricted services or with non-typical host-local firewall rules), though it should be fine, if you're using semi-reasonable passwords. SSH supports unix domain socket forwarding and even cross unix/ip forwarding with a syntax like: ssh -L /path/to/sock:/path/to/sock ssh -L /path/to/sock:localhost:5901 ssh -L 5091:/path/t…
Wow that's amazing, I've been cobbling together socat processes because I didn't know this was possible.
Re: A visual guide to SSH tunnels
#63For those interested in the topic of tunneling, I highly recommend The Cyber Plumber’s Handbook [1] to gain an even deeper understanding and examples beyond SSH. [1] https://cph.opsdisk.com/
Appreciate the shout out magicconch! Just added a HN family discount to pick up the book, lab guide, and lab access for $10.
Re: A visual guide to SSH tunnels
#64Why don't people use unix domain sockets for local connections? They are pretty much the same thing as local IP connections, except access rights apply as on files, so you're not exposing connections to pretty much all processes. Domain sockets can be forwarded via ssh with the same -L and -R arguments, including cross unix/ip forwardings.
It's a relatively recent feature in openssh (in the past decade for upstream; not sure when it first landed in an Ubuntu LTS, which for practical purposes is the earliest one might start using it regularly)
Re: A visual guide to SSH tunnels
#65For those interested in the topic of tunneling, I highly recommend The Cyber Plumber’s Handbook [1] to gain an even deeper understanding and examples beyond SSH. [1] https://cph.opsdisk.com/
Appreciate the shout out magicconch! Just added a HN family discount to pick up the book, lab guide, and lab access for $10. https://gum.co/cph_book_and_lab/hackernews20210207
very cool, just grabbed a copy.
Re: A visual guide to SSH tunnels
#66Earlier quoted context omitted.
[note I am wrong here - it doesn't support UDP - see below] The ssh SOCKS proxy supports UDP. I use Firefox with a SOCKS proxy via ssh (e.g. ssh -D 2222 hostname) to get around geoblocking and accessing papers via an institutional account. The tsocks program can also let you use a SOCKS proxy for an arbitrary command in linux. I find it much more convenient than a VPN, as it can be easily applied to single programs.
Note that the default port for SOCKS(5) is 1080, and the de facto standard for (forward) web proxies (e.g., Squid) is 3128, so one may want to make of habit of using one of those ports.
3128 is a common http/s proxy sure, but so is 8080, and I've seen 80 a few times too.
1080 is often default for socks, but I've also seen places where it's 1085 (for socks5 -- 1084 for socks4)
Ultimately it can be whatever you want.
Re: A visual guide to SSH tunnels
#67Great write up! One thing to add is that you can even open tunnels during an interactive session without disconnection. To do this, type the escape command sequence ~C (will not show) and it will drop you to the control prompt. You can then add tunnels. ssh> ssh> -L 8000:localhost:9000 Forwarding port.
Since this tip is popular I'll share another related tip. When using nested ssh session, you can send escape commands to any of them by the number of tildes. For example, if you ssh into Server A and then from Server A to Server B: ~~. # drop session from Server A to Server B ~. # drop original session into Server A
I sometimes have to hit a before the ~. disconnect works. Not sure why.
Re: A visual guide to SSH tunnels
#68Earlier quoted context omitted.
Since this tip is popular I'll share another related tip. When using nested ssh session, you can send escape commands to any of them by the number of tildes. For example, if you ssh into Server A and then from Server A to Server B: ~~. # drop session from Server A to Server B ~. # drop original session into Server A
I sometimes have to hit a before the ~. disconnect works. Not sure why.
Because iirc, ssh only interprets the tilde if it's immediately preceded by a newline.
Re: A visual guide to SSH tunnels
#69Is it just me or is this site a bit of a disaster on mobile?
On desktop firefox all of the code snippets are black-on-black so I have to select the code to read it.
Re: A visual guide to SSH tunnels
#70There's a really fancy new -R feature that I love (added in 2017 I think). ssh -R This opens up a localhost port on the target that acts as a socks server which tunnels all your traffic through the source machine. This is great for machines that you can SSH into, but are otherwise completely isolated from the network, or are monitored heavily. You can jump on, and pull down everything you need from the existing SSH c…
> (added in 2017 I think)
Indeed: committed in September 2017, released in v7.6 in October 2017.