Persistent SSH Tunnels - Revision history

Kg7qin at 04:17, 14 July 2021

2021-07-14T04:17:51Z

Kg7qin: /* Setup script */

2018-11-10T02:21:32Z

Setup script

Kg7qin at 02:19, 10 November 2018

2018-11-10T02:19:49Z

Kg7qin: Initial page creation

2018-11-10T02:18:11Z

Initial page creation

New page

=Persistent SSH Tunnels=

The following is how to create a persistent SSH Tunnel between two systems. This is handy if you want to secure data flowing across networks, or even setup a tunnel without messing with VPN configuration.

=Create User/Generate SSH key=

First you will create the user you will use for the tunnel. This will allow you to forward non-privileged ports over 1024.

''Note: This user does not have a password assigned or a shell. This will prevent user logins to the system.''

<pre>
useradd -m -s /bin/false autossh
</pre>

Now switch to the user and generate an SSH key:

<pre>
su -s /bin/bash useradd
cd ~
ssh-keygen -b 4096
</pre>

''Note: Leave password blank''

Once done, exit back to your normal user shell

<pre>
exit
</pre>

=Copy public key to target system=

You will need to copy '''''id_rsa.pub''''' file from '''''/home/useradd/.ssh/''''' to the '''''authorized_keys''''' file on the remote system you want to connect to for the tunnel.

''Note: It is recommended that you also create a normal user on the remote system and not use root.''

=Install autossh=

You will need to install the autossh program on the system that will initiate the SSH tunnel. Autossh automatically restarts the SSH tunnel when it exits.

<pre>
apt-get install autossh
</pre>

=Setup script=

Copy the following script, making the necessary changes as specified between the <> and place on the system that will initiate the tunnel (usually /opt):

<pre>
#!/bin/sh
#
# Uses autossh to establish a tunnel to allstarlink.org for the Graylog Collector Sidecar
# on seal to pass data.

su -s /bin/sh autossh -c 'autossh -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -o "ExitOnForwardFailure=yes" -f -T -R localhost:<target port>:<local IP or localhost>:<local port> <user>@<domain>'

</pre>

{| class="wikitable"
! Parameter !! Description
|-
| localhost || localhost or IP address on target system
|-
| <target port> || port on target system
|-
| <local IP or localhost> || localhost or IP address on system initiating tunnel
|-
| <local port> || port on system initiating tunnel
|-
| <user@domain> || username and domain to use when SSHing to target system
|}

An example of this command is:

<pre>
su -s /bin/sh autossh -c 'autossh -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -o "ExitOnForwardFailure=yes" -f -T -R localhost:3306:localhost:3306 joe@blow.com'
</pre>

This would allow the target (remote) system to access the local (system initiating the SSH tunnel) system's MySQL server over the tunnel.

You can also use -L to change the direction of the port forwarding from Remote to Local and have the initiating system forward data over the tunnel the the remote.

=Make script executable=

Make sure you mark the script as executable with:

<pre>
chmod +x <name_of_script>.sh
</pre>

=Tunnel at startup=

To have this tunnel automatically start if the system is rebooted, add a call to the script to rc.local.

<pre>
/opt/<name_of_script>.sh
</pre>

''Note: You may have to enable rc.local on Ubuntu and Debian based systems via systemd. Refer to your distributions documentation for information on how to enable it.''

← Older revision		Revision as of 04:17, 14 July 2021
Line 1:		Line 1:
		+	[[Category:How to]]
		+	[[Category:Node Configuration]]
	=Persistent SSH Tunnels=		=Persistent SSH Tunnels=

← Older revision		Revision as of 02:19, 10 November 2018
Line 98:		Line 98:


−	''Note: You may have to enable rc.local on Ubuntu and Debian based systems via systemd. Refer to your ~~distributions~~ documentation for information on how to enable it.''	+	''Note: You may have to enable rc.local on Ubuntu and Debian based systems via systemd. Refer to your distribution's documentation for information on how to enable it.''

@@ Line 53: / Line 53: @@
 # on seal to pass data.
-su -s /bin/sh autossh -c 'autossh -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -o "ExitOnForwardFailure=yes" -f -T -R localhost:<target port>:<local IP or localhost>:<local port> <user>@<domain>'
+su -s /bin/sh autossh -c 'autossh -M 0 -N -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -o "ExitOnForwardFailure=yes" -f -T -R <target IP or localhost>:<target port>:<local IP or localhost>:<local port> <user>@<domain>'
 </pre>
@@ Line 60: / Line 60: @@
 ! Parameter !! Description
 |-
-|  localhost || localhost or IP address on target system
+|  <target IP or localhost> || localhost or IP address on target system
 |-
 |  <target port> || port on target system