[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: reverse SSH / SSH over NAT traversal

Konstantin Svist wrote:
Hi all,

I'm trying to connect to a remote host to do some simple support. The remote host is behind a NAT/firewall and it's not possible to ask the admin to tunnel a port. The remote host has a live person working on it (a linux newbie). The question is, can the remote user type in some command in their terminal to connect (SSH?) to my network - and thereby allow me to get a terminal on the remote machine. I think this is possible with a reverse SSH tunnel - but I don't really want to allow the remote user any access to my system. It's probably possible to set up some chroot or otherwise locked out environment (/bin/nologin ?), but I want to first check if there are any simpler options.

A better question: is it possible to establish an SSH connection if both networks have NAT/firewalls that can't be easily controlled? I know some programs (e.g. skype) are able to traverse NATs by various means (UDP). Can some tunnel of this sort be established so that an SSH connection can be established on top of that?


I've never tried using chroot for anything but to handle the ssh issue have the user enter the command:

ssh -R 12345: username yourhost

have the user login.  At this point you can enter:

ssh -p 12345 username 127 0 0 1

where usename is the username on your clients machine.

If you want to take it one step further you can enter:

ssh -D 4567 -p 12345 username 127 0 0 1

now your local machine is running as if its a socks proxy and any software that can be told to use a proxy will be able to connect to the remote network, set the proxy host to be and the port to be 4567 (you can adjust the port if you like)

What I do for my own use is use the "-D" option and a program I found called "connect"
and then put in ~/.ssh/config these two lines:

host 10.*
ProxyCommand /usr/local/bin/connect -4 -S %h %p

you can do "host *.foo.com" as well and it will match anything in the .foo.com domain.

Now every time I type "ssh username 10 x x x" it automatically proxies my connection if the ssh tunnel is up.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]