It's 3 a.m. and you have been paged by one of your monitoring systems that another service is down. Your employer requires extreme security. There is no modem pool behind your firewall with which you can get inside, and no one can justify the cost of a VPN to your CEO.
That means it's time to drive down to the office and hope your keycard still works. Here's an alternative.
This article explains how to use an SSH tunnel and port forwarding to securely reach systems inside a firewall-protected network by originating a secure outbound SSH connection.
One Tool, One Mission
SSH (Secure Shell) version 2 can create encrypted tunnels over a single TCP port and securely forward traffic through that tunnel.
Most administrators know SSH as a secure replacement for telnet, but it can also securely carry many other protocols.
- Encrypted transmissions protect sensitive data.
- Traffic crossing the public Internet appears as encrypted noise.
- The command-line interface performs well even over low bandwidth connections.
- SSH software is freely available and widely supported.
Assumptions
- You have Internet connectivity from home.
- Your home system can accept incoming SSH connections.
- SSH client and server software are installed on both systems.
- Your home SSH daemon is listening on port 22.
Making It Happen
From your office workstation:
ssh -R 32000:localhost:23 -l jdoe ppp25.den.myisp.comThis command maps port 32000 on your home system back to port 23 (telnet) on your office workstation through an encrypted SSH tunnel.
Once connected, you can test the reverse tunnel from home:
telnet localhost 32000You should now see the login prompt from your office workstation.
Advanced Port Forwarding
SSH can forward multiple services simultaneously:
ssh -R 32000:localhost:23 -L 32001:smtp.abigcorp.com:25 \
-l jdoe ppp25.den.myisp.comThis forwards:
- Office workstation telnet service through the reverse tunnel
- Corporate SMTP traffic through a local forward
Conclusion
SSH is one of the most powerful tools available to UNIX administrators. Used correctly, it allows secure remote administration without exposing internal systems directly to the public Internet.
David Beecher is a Sr. UNIX Systems Administrator with experience in electronics, robotic control systems, assembly language programming, and UNIX infrastructure.