SSH interception - Linux
Really hoping someone here can point me in the right direction,
Expected result: SSH successfully into a remote device.
Challenge/Back story:
We have devices out in remote places around the country,
These devices do not have a fixed public IP address
(Using GSM as its internet breakout)
These devices are able to SSH and break out.
My thought, with regards to maintaining these devices is to (if possible) use a server in the cloud as a middle man, have these devices create some sort of a reverse tunnel to our middleman server then have us as admins intercept it or something to that effect.
Again to summarize, Device cannot be ssh'd into directly, but can breakout.
Aim to be able to hit their terminal from the office.
have been looking at mitmssh but not coming right on that front.
Server A (no fixed address, cannot SSH into it directly but has breakout)
Server B (standard server which can be used as a middle man
Server C (Us admins)
Tried something along the lines of "ssh user@serverA -R serverB:12345:ServerA:22"
Which creates the tunnel, but struggling with grabbing hold of that SSH connection.
linux ssh
asked Nov 28 '18 at 5:01
Julian KrielJulian Kriel
75
|
show 1 more comment
Really hoping someone here can point me in the right direction,
Expected result: SSH successfully into a remote device.
Challenge/Back story:
We have devices out in remote places around the country,
These devices do not have a fixed public IP address
(Using GSM as its internet breakout)
These devices are able to SSH and break out.
My thought, with regards to maintaining these devices is to (if possible) use a server in the cloud as a middle man, have these devices create some sort of a reverse tunnel to our middleman server then have us as admins intercept it or something to that effect.
Again to summarize, Device cannot be ssh'd into directly, but can breakout.
Aim to be able to hit their terminal from the office.
have been looking at mitmssh but not coming right on that front.
Server A (no fixed address, cannot SSH into it directly but has breakout)
Server B (standard server which can be used as a middle man
Server C (Us admins)
Tried something along the lines of "ssh user@serverA -R serverB:12345:ServerA:22"
Which creates the tunnel, but struggling with grabbing hold of that SSH connection.
linux ssh
asked Nov 28 '18 at 5:01
Julian KrielJulian Kriel
75
1
I'm voting to close this question as off-topic because it's not a programming question in any way, shape or form, but a networking one. As such, and given that it's about ssh, I'd suggest you ask this at unix.stackexchange.com, superuser.com/questions/tagged/linux# or serverfault.com/questions
– tink
Nov 28 '18 at 7:10
1
Thanks for the links, Was unclear on it being programming specific, My apologies
– Julian Kriel
Nov 28 '18 at 7:13
For the reference: they CAN be sshed into directly (if you choose to make it so), you just don't know their IP. What I do to get into my machine is to make it "call home", pushing it's current IP every five minutes to an IP I can always access. I do this via cating and a forced command on the far end.
– tink
Nov 28 '18 at 7:14
No worries. It's a good question. ;) Just the wrong place.
– tink
Nov 28 '18 at 7:15
Thanks a mil, Found their public IP changes each time it makes a connection through GSM, must have something to do with the Mobile operator. Will try your suggestion though, thanks again
– Julian Kriel
Nov 28 '18 at 7:26
|
show 1 more comment
Really hoping someone here can point me in the right direction,
Expected result: SSH successfully into a remote device.
Challenge/Back story:
We have devices out in remote places around the country,
These devices do not have a fixed public IP address
(Using GSM as its internet breakout)
These devices are able to SSH and break out.
My thought, with regards to maintaining these devices is to (if possible) use a server in the cloud as a middle man, have these devices create some sort of a reverse tunnel to our middleman server then have us as admins intercept it or something to that effect.
Again to summarize, Device cannot be ssh'd into directly, but can breakout.
Aim to be able to hit their terminal from the office.
have been looking at mitmssh but not coming right on that front.
Server A (no fixed address, cannot SSH into it directly but has breakout)
Server B (standard server which can be used as a middle man
Server C (Us admins)
Tried something along the lines of "ssh user@serverA -R serverB:12345:ServerA:22"
Which creates the tunnel, but struggling with grabbing hold of that SSH connection.
linux ssh
asked Nov 28 '18 at 5:01
Julian KrielJulian Kriel
75
Really hoping someone here can point me in the right direction,
Expected result: SSH successfully into a remote device.
Challenge/Back story:
We have devices out in remote places around the country,
These devices do not have a fixed public IP address
(Using GSM as its internet breakout)
These devices are able to SSH and break out.
My thought, with regards to maintaining these devices is to (if possible) use a server in the cloud as a middle man, have these devices create some sort of a reverse tunnel to our middleman server then have us as admins intercept it or something to that effect.
Again to summarize, Device cannot be ssh'd into directly, but can breakout.
Aim to be able to hit their terminal from the office.
have been looking at mitmssh but not coming right on that front.
Server A (no fixed address, cannot SSH into it directly but has breakout)
Server B (standard server which can be used as a middle man
Server C (Us admins)
Tried something along the lines of "ssh user@serverA -R serverB:12345:ServerA:22"
Which creates the tunnel, but struggling with grabbing hold of that SSH connection.
linux ssh
linux ssh
asked Nov 28 '18 at 5:01
Julian KrielJulian Kriel
75
asked Nov 28 '18 at 5:01
Julian KrielJulian Kriel
75
asked Nov 28 '18 at 5:01
Julian KrielJulian Kriel
75
asked Nov 28 '18 at 5:01
Julian KrielJulian Kriel
75
asked Nov 28 '18 at 5:01
Julian KrielJulian Kriel
75
75
1
I'm voting to close this question as off-topic because it's not a programming question in any way, shape or form, but a networking one. As such, and given that it's about ssh, I'd suggest you ask this at unix.stackexchange.com, superuser.com/questions/tagged/linux# or serverfault.com/questions
– tink
Nov 28 '18 at 7:10
1
Thanks for the links, Was unclear on it being programming specific, My apologies
– Julian Kriel
Nov 28 '18 at 7:13
For the reference: they CAN be sshed into directly (if you choose to make it so), you just don't know their IP. What I do to get into my machine is to make it "call home", pushing it's current IP every five minutes to an IP I can always access. I do this via cating and a forced command on the far end.
– tink
Nov 28 '18 at 7:14
No worries. It's a good question. ;) Just the wrong place.
– tink
Nov 28 '18 at 7:15
Thanks a mil, Found their public IP changes each time it makes a connection through GSM, must have something to do with the Mobile operator. Will try your suggestion though, thanks again
– Julian Kriel
Nov 28 '18 at 7:26
|
show 1 more comment
1
I'm voting to close this question as off-topic because it's not a programming question in any way, shape or form, but a networking one. As such, and given that it's about ssh, I'd suggest you ask this at unix.stackexchange.com, superuser.com/questions/tagged/linux# or serverfault.com/questions
– tink
Nov 28 '18 at 7:10
1
Thanks for the links, Was unclear on it being programming specific, My apologies
– Julian Kriel
Nov 28 '18 at 7:13
For the reference: they CAN be sshed into directly (if you choose to make it so), you just don't know their IP. What I do to get into my machine is to make it "call home", pushing it's current IP every five minutes to an IP I can always access. I do this via cating and a forced command on the far end.
– tink
Nov 28 '18 at 7:14
No worries. It's a good question. ;) Just the wrong place.
– tink
Nov 28 '18 at 7:15
Thanks a mil, Found their public IP changes each time it makes a connection through GSM, must have something to do with the Mobile operator. Will try your suggestion though, thanks again
– Julian Kriel
Nov 28 '18 at 7:26
1
1
I'm voting to close this question as off-topic because it's not a programming question in any way, shape or form, but a networking one. As such, and given that it's about ssh, I'd suggest you ask this at unix.stackexchange.com, superuser.com/questions/tagged/linux# or serverfault.com/questions
– tink
Nov 28 '18 at 7:10
I'm voting to close this question as off-topic because it's not a programming question in any way, shape or form, but a networking one. As such, and given that it's about ssh, I'd suggest you ask this at unix.stackexchange.com, superuser.com/questions/tagged/linux# or serverfault.com/questions
– tink
Nov 28 '18 at 7:10
1
1
Thanks for the links, Was unclear on it being programming specific, My apologies
– Julian Kriel
Nov 28 '18 at 7:13
Thanks for the links, Was unclear on it being programming specific, My apologies
– Julian Kriel
Nov 28 '18 at 7:13
For the reference: they CAN be sshed into directly (if you choose to make it so), you just don't know their IP. What I do to get into my machine is to make it "call home", pushing it's current IP every five minutes to an IP I can always access. I do this via cating and a forced command on the far end.
– tink
Nov 28 '18 at 7:14
For the reference: they CAN be sshed into directly (if you choose to make it so), you just don't know their IP. What I do to get into my machine is to make it "call home", pushing it's current IP every five minutes to an IP I can always access. I do this via cating and a forced command on the far end.
– tink
Nov 28 '18 at 7:14
No worries. It's a good question. ;) Just the wrong place.
– tink
Nov 28 '18 at 7:15
No worries. It's a good question. ;) Just the wrong place.
– tink
Nov 28 '18 at 7:15
Thanks a mil, Found their public IP changes each time it makes a connection through GSM, must have something to do with the Mobile operator. Will try your suggestion though, thanks again
– Julian Kriel
Nov 28 '18 at 7:26
Thanks a mil, Found their public IP changes each time it makes a connection through GSM, must have something to do with the Mobile operator. Will try your suggestion though, thanks again
– Julian Kriel
Nov 28 '18 at 7:26
|
show 1 more comment
1 Answer
1
active
oldest
votes
I think I regularly use something very similar. My target machine connects to the machine with a stable address with:
ssh midpoint -R 2022:localhost:22
my ~/.ssh/config file knows the real HostName. My config file on my work machine defines a ProxyCommand option to use this tunnelled TCP connection. like:
Host target
ProxyCommand ssh -q midpoint nc localhost 2022
the reason for using netcat was to get ssh-agent behaving.
I've just been searching around and it seems OpenSSH now has specific handling for this (-W command line option, and JumpHost in the config file). E.g. https://stackoverflow.com/a/29176698/1358308
answered Nov 28 '18 at 22:04
Sam MasonSam Mason
3,34811331
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53512441%2fssh-interception-linux%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I think I regularly use something very similar. My target machine connects to the machine with a stable address with:
ssh midpoint -R 2022:localhost:22
my ~/.ssh/config file knows the real HostName. My config file on my work machine defines a ProxyCommand option to use this tunnelled TCP connection. like:
Host target
ProxyCommand ssh -q midpoint nc localhost 2022
the reason for using netcat was to get ssh-agent behaving.
I've just been searching around and it seems OpenSSH now has specific handling for this (-W command line option, and JumpHost in the config file). E.g. https://stackoverflow.com/a/29176698/1358308
answered Nov 28 '18 at 22:04
Sam MasonSam Mason
3,34811331
add a comment |
I think I regularly use something very similar. My target machine connects to the machine with a stable address with:
ssh midpoint -R 2022:localhost:22
my ~/.ssh/config file knows the real HostName. My config file on my work machine defines a ProxyCommand option to use this tunnelled TCP connection. like:
Host target
ProxyCommand ssh -q midpoint nc localhost 2022
the reason for using netcat was to get ssh-agent behaving.
I've just been searching around and it seems OpenSSH now has specific handling for this (-W command line option, and JumpHost in the config file). E.g. https://stackoverflow.com/a/29176698/1358308
answered Nov 28 '18 at 22:04
Sam MasonSam Mason
3,34811331
add a comment |
I think I regularly use something very similar. My target machine connects to the machine with a stable address with:
ssh midpoint -R 2022:localhost:22
my ~/.ssh/config file knows the real HostName. My config file on my work machine defines a ProxyCommand option to use this tunnelled TCP connection. like:
Host target
ProxyCommand ssh -q midpoint nc localhost 2022
the reason for using netcat was to get ssh-agent behaving.
I've just been searching around and it seems OpenSSH now has specific handling for this (-W command line option, and JumpHost in the config file). E.g. https://stackoverflow.com/a/29176698/1358308
answered Nov 28 '18 at 22:04
Sam MasonSam Mason
3,34811331
I think I regularly use something very similar. My target machine connects to the machine with a stable address with:
ssh midpoint -R 2022:localhost:22
my ~/.ssh/config file knows the real HostName. My config file on my work machine defines a ProxyCommand option to use this tunnelled TCP connection. like:
Host target
ProxyCommand ssh -q midpoint nc localhost 2022
the reason for using netcat was to get ssh-agent behaving.
I've just been searching around and it seems OpenSSH now has specific handling for this (-W command line option, and JumpHost in the config file). E.g. https://stackoverflow.com/a/29176698/1358308
answered Nov 28 '18 at 22:04
Sam MasonSam Mason
3,34811331
answered Nov 28 '18 at 22:04
Sam MasonSam Mason
3,34811331
answered Nov 28 '18 at 22:04
Sam MasonSam Mason
3,34811331
answered Nov 28 '18 at 22:04
Sam MasonSam Mason
3,34811331
3,34811331
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53512441%2fssh-interception-linux%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
I'm voting to close this question as off-topic because it's not a programming question in any way, shape or form, but a networking one. As such, and given that it's about ssh, I'd suggest you ask this at unix.stackexchange.com, superuser.com/questions/tagged/linux# or serverfault.com/questions
– tink
Nov 28 '18 at 7:10
1
Thanks for the links, Was unclear on it being programming specific, My apologies
– Julian Kriel
Nov 28 '18 at 7:13
For the reference: they CAN be sshed into directly (if you choose to make it so), you just don't know their IP. What I do to get into my machine is to make it "call home", pushing it's current IP every five minutes to an IP I can always access. I do this via cating and a forced command on the far end.
– tink
Nov 28 '18 at 7:14
No worries. It's a good question. ;) Just the wrong place.
– tink
Nov 28 '18 at 7:15
Thanks a mil, Found their public IP changes each time it makes a connection through GSM, must have something to do with the Mobile operator. Will try your suggestion though, thanks again
– Julian Kriel
Nov 28 '18 at 7:26