1. daemon issue 14 http://daemon.di.uoa.gr/daemon/issue14 SSH Port Forwarding Yannis Tsopokis Wednesday, April 26 th 2006

2. SSH (SSH client) is a program that allows as to connect to a remote computer and execute commands. Its difference from telnet is that it establishes a secure (encrypted) communication channel. Furthermore we can send any kind of data through this channel. We will discuss how we can use ssh to establish a secure channel, not for executing remote commands, but to transfer data, even between nodes that cannot contact each other directly (due to firewalling or other reasons) What is ssh SSH port forwardingWednesday, April 26 th 2006 2

3. Lets say we want to connect with an Oracle DB server that only accepts database connections from an ip range. How can we connect to the db server from another ip? With ssh -L ! ssh -L : : user@host-gateway You specify that port xxx of the local host will be forwarded to port yyy of remote-host, through host-gateway. ***Only root can forward privileged ports (<=1024)*** What we want to do How to use it SSH port forwardingWednesday, April 26 th 2006 3

4. ssh -L 1521:dbserver.domain.com:1521 userx@host.domain.com -Nf which forwards local port 1521 (oracle default), through host.domain.com (which must have sshd running), at port 1521 of dbserver. We will be asked for our password of userx at host.domain.com! client host dbserver incoming port 1521 Example incoming port 1521 SSH port forwardingWednesday, April 26 th 2006 4

5. ssh -L 1521:dbserver.domain.com:1521 userx@dbserver.domain.com -Nf in this case we have the same result but it is more secure since the data travel through the encrypted channel up to dbserver, while in the previous example data travelled unencrypted from host to dbserver. client dbserver incoming port 1521 Example incoming port 1521 SSH port forwardingWednesday, April 26 th 2006 5

6. Another occasion is when we want to mount a remote file system, and we cannot talk to the remote host directly. we first open the encrypted channel ssh -L 6666:192.168.0.1:139 user@gateway -Nf and then mount the remote file system mount -t smbfs -o port=6666 //localhost/share/remote_folder Mount remote filesystem SSH port forwardingWednesday, April 26 th 2006 6

7. localhost remote ssh -R : : user@remote-host There also is reverse port forwarding, which does the reverse. It forwards port xxx of remote-host to port yyy of local-host. Reverse port forwarding incoming port xxx incoming port yyy SSH port forwardingWednesday, April 26 th 2006 7

8. The end! SSH port forwardingWednesday, April 26 th 2006 8 References: [1] Openssh : http://www.openssh.com [2] SSH: The Secure Shell, O'Reilly Book by Danie J. Barret & Richard E. Silverman. [3] man page of ssh. [4] ProxyTunnel: http://proxytunnel.sourceforge.net/papers/muppet-200204.html [5] ssh tunnels: http://www.linuxlogin.com/linux/admin/sshtunnels.php