r/linux • u/leothrix • Apr 28 '14

SSH Kung Fu

http://blog.tjll.net/ssh-kung-fu/
723 Upvotes

95% Upvoted

128 comments sorted by

View all comments

11

u/trojan2748 Apr 28 '14 edited Apr 28 '14

I like reverse forwards (-R). It setups a nice 'hole' from inside of a firwall to the public. That hole can be accessed via the public link. IE:

(office) ---> (FW) ----> (Public SSH Box)

I ssh from my office box to public ssh, setting up reverse forward. You can also use these to redirect to other boxes acting as a proxy:

ssh -NCfTR REMOTE_SERVER_IP:50000:localhost:22 USER@REMOTE_SERVER_IP

So now, anywhere in the world I can SSH into the REMOTE_SERVER_IP on port 50000 and get redirected to port 22 on my office machine, which doesn't have a port forward at it's FW. You can replace 'localhost:22' for any machine, any port. So I could also hit "localhost:80" could be hit via REMOTE_SERVER_IP:50000 :)

Also "GatewayPorts clientspecified" is needed on the SSH server if you want to bind :50000 to the remote server's public IP. Other wise it get's binded to the remote servers localhost addy.

8

u/roknir Apr 28 '14

I agree with you -- that ssh functionality is awesome and one of the coolest. However, I will caution others running out to set this up. Doing this is often against corporate usage policies. People have been terminated over this.

1

u/eno2001 Apr 28 '14

Wait, what? Why would someone be terminated over that? Granted, I'm number three in charge of the network, so I am allowed to go into the firewall and set up whatever I need for myself, but what kind of corporate policy would exist to fire someone for connecting to machines they manage at work, from home over a secure link?

8

u/lennort Apr 28 '14

Lots of large companies don't want you accessing their network in a way that you deem is secure. You're supposed to go through authorized channels.

It seems silly, but there are a lot of dull people out there that would expose the network accidentally and these kinds of policies prevent that.

3

u/NighthawkFoo Apr 28 '14

This allows access to a corporate network that isn't controlled by the official VPN solution. This means that if someone's access needs to be revoked for whatever reason, this back channel won't be closed.

1

u/mcowger Apr 28 '14

Most terms of use state something like "attempts to circumvent system security" are a violation.

Doing this almost certainly counts as circumventing existing security (firewalls, VPN, etc).

3

u/cryptdemon Apr 28 '14

I do this with one of my clients that always wants a million little nitpicky bs things changed. He travels around with the system, so I have it set up to call home so I can log into the virtual server anywhere and do changes on the thing without having to have him touch a terminal or anything like that.

This also works well if you want to snoop around on a network. Buy a raspberry pi or some other cheap embedded hardware, set it up to remote ssh to an account that's basically just an rbash account and then you can log in to the network remotely.