Skip to main content

linux - Establishing an SSH connection between machines behind firewalls


I have two machines, A and C, each of which is behind a firewall so they can’t accept incoming SSH requests on port 22. I have a third machine, B, outside both firewalls and I wanted to SSH from A to C using B. I am able to do what I think is called an SSH tunnel from C -> B like so


ssh -fNR 10000:localhost:22 -i key_file_for_B_on_C user_on_B@B

Following what looks like the almost what I want on this question I now try the command:


ssh -ti key_file_for_C_on_A -l user_on_C -o "ProxyCommand ssh -ti key_file_for_B_on_A -W %h:%p user_on_B@B" -p 10000 B

That doesn’t seem to work, I get the error:


channel 0: open failed: connect failed: Connection timed out

Is this the right approach? What might I be doing wrong?



Answer



I think the problem with your example is the final arguments; you are sshing to B, when you should be listing the "final destination", albeit the port-forwarded host/port, which is port 10000, but should be localhost, not B, as B is resolved from the perspective of A, and port 10000 on B is probably not open externally. E.g., corrected:


ssh -ti key_file_for_C_on_A -l user_on_C -o "ProxyCommand ssh -ti key_file_for_B_on_A -W %h:%p user_on_B@B" -p 10000 localhost

To prove it to myself, I setup the same experiment, albeit slightly simpler since my username is the same on all hosts, and I'm using agent forwarding; note that my hophost (your B) accepts ssh on a non-standard port, 2222.


On C:


ssh -fNAR 12345:localhost:22 hophost -p 2222

Then on A:


ssh -A localhost -p 12345 -o "ProxyCommand ssh -A hophost -p 2222 nc %h %p"

Alternatively, you can encode a bunch of this into your .ssh/config on A:


Host C
  HostName localhost
  Port 12345
  ForwardAgent yes
  #ProxyCommand ssh -A hophost -p 2222 nc %h %p
  ProxyCommand ssh -A hophost -p 2222 -W %h:%p
  #ProxyCommand $HOME/.ssh/proxy -w 2 -h hophost:2222 %h %p

Then your command on A is simply


ssh C

Note I also included two alternative ProxyCommand versions. The first uses nc in case your ssh version is older than 5.3, when the -W option was added. The other uses a proxy script I've used for a long time to both hop-through some hosts (as in this example) and use corkscrew to get out from firewalls which block outbound ssh. You can see the ssh-proxy script on my github. It simplifies ~/.ssh/config entries when you want to use a proxy for Host * entries, but I don't promise that it always works in all situations, as I've modified it over time as I've needed to for different situations, so any of the options might be fragile or even busted, but it might help.


Comments

Post a Comment

Popular Posts

How do I transmit a single hexadecimal value serial data in PuTTY using an Alt code?

I am trying to sent a specific hexadecimal value across a serial COM port using PuTTY. Specifically, I want to send the hex codes 9C, B6, FC, and 8B. I have looked up the Alt codes for these and they are 156, 182, 252, and 139 respectively. However, whenever I input the Alt codes, a preceding hex value of C2 is sent before 9C, B6, and 8B so the values that are sent are C2 9C, C2 B6, and C2 8B. The value for FC is changed to C3 FC. Why are these values being placed before the hex value and why is FC being changed altogether? To me, it seems like there is a problem internally converting the Alt code to hex. Is there a way to directly input hex values without using Alt codes in PuTTY? Answer What you're seeing is just ordinary text character set conversion. As far as PuTTY is concerned, you are typing (and reading) text , not raw binary data, therefore it has to convert the text to bytes in whatever configured character set before sending it over the wire. In other words, when y...
Post a Comment
Read more

linux - Extract/save a mail attachment using bash

Using normal bash tools (ie, built-ins or commonly-available command-line tools), is it possible, and how to extract/save attachments on emails? For example, say I have a nightly report which arrives via email but is a zip archive of several log files. I want to save all those zips into a backup directory. How would I accomplish that? Answer If you're aiming for portability, beware that there are several different versions of mail(1) and mailx(1) . There's a POSIX mailx command, but with very few requirements. And none of the implementations I have seem to parse attachments anyway. You might have the mpack package . Its munpack command saves all parts of a MIME message into separate files, then all you have to do is save the interesting parts and clean up the rest. There's also metamail . An equivalent of munpack is metamail -wy .
Post a Comment
Read more

performance - Single Threaded Qaud Core v.s Hyper-Threading Dual Core

Let's say we have two CPUs, One is Quad Core 3.2 Ghz with 4 Cores, and We have a Dual Core 3.2 Ghz with 2 Cores with 2 threads in each Core (Hyper-Threading). My assumption as a programmer will be, the 4 cores 4 threads should perform faster than 2 cores 4 threads since the second CPU needs to switch between threads in order to emulate 4 cores while the first one doesn't need to perform such switching as each core can perform independently and individually. I want to confirm that my assumption is true, if not please explain why one is better than the other. Answer I do believe thats true - since hyper threading does share some elements - specifically the main execution resources, you'll be able to run 4 full threads at once, rather than waiting for those resources to be freed up. The point of HT is to get better performance with a smaller use of die area - your quad core would generally be a bigger chip - say almost twice as large, than a non HT dual core chip, while a HT...
Post a Comment
Read more

freeze - How do I stop windows 8.1 from freezing when the screen locks

This happens to me on a regular basis if I leave the computer for upwards of 10 minutes. It didnt do so at first but started after a couple of days. This is possibly related to further windows updates although nothing seems to tie in obviously when looking at my update history. I have to hold the power button in to power off. If the screens have switched off aswell they wont come back on, if they haven't I see the login picture and can move the mouse pointer but nothing happens and no combination of keyboard mashes or mouse clicks lets me see the login prompt. In the event log (type event viewer into the start menu) under system before every Critical problem (me powering down the machine without restarting) I get distributedCOM errors talking about this guid: "The server {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} did not register with DCOM within the required timeout." I also get the same error for this 1B1F472E-3221-4826-97DB-2C2324D389AE. This seems to be a common theme and...
Post a Comment
Read more