▲ 22 points

Show HN: Public SSH Jump and Port Forwarding Server

by ValdikSS·5y ago·4 comments·view on hn ↗

I've made a neat service to access SSH over NAT. Unlike ngrok and alternatives with registration, custom software, non-preserved random URLs and ports, this solution is just a remote SSH server which does not require anything more than an SSH client to both host and connect.

Technically it allows to publish any service over SSH (web, proxy, any TCP port really), but only with SSH as a destination you'll preserve end-to-end encryption and won't allow my server to snoop on potentially unencrypted traffic.

The service is mostly intended to give remote access to the device as fast as possible, given it already has SSH client and server.

To begin, just execute:

    ssh ssh-j.com

Would be grateful for any feedback.

-----

Looking for ways to expose SSH behind NAT? Search no further!

Publish SSH server port of your laptop, which is behind NAT:

     ssh any-username@ssh-j.com -N -R laptop-behind-nat:22:localhost:22
       ╭─╯  unique  ╰─╮               │  device name ╭───╯ │destination│
       │  namespace   │               │    and port  │     │address and│
       │for your hosts│               ╰──────────────╯     │    port   │
       ╰──────────────╯                                    ╰───────────╯

Connect to the published SSH:

     ssh -J any-username@ssh-j.com laptop-behind-nat
           ↖
             It's THAT easy!

Published hosts are bound to the username. Other usernames can't access them. Pick a unique username (not root ) and get access to your devices anywhere!

4 comments

any way to use this for e.g. vnc forwarding directly? I mean, I can set it to be available via ssh but would that work?

ssh someuser@ssh-j.com -N -R some-pc:5901:localhost:5901

Now do I reach this from my vnc? I need the "someuser" and -J part when connecting? Would I have to setup another ssh connection from my local pc to ssh-j and then use localhost:5901 in vnc?

How does this part work:

-R laptop-behind-nat:22:localhost:22

This should open port 22 on the ssh-j.com server and connect it back to the laptop-behind-nat:22 , but this is already open. So, you're doing some firewall trickery to redirect 127.0.0.1:22 to a different port based on the username? And sshd isn't listening on 127.0.0.1:22?

If so, could a person also try:

-R laptop-behind-nat:22:localhost:22222

-R laptop-behind-nat:22:localhost:22223

-R laptop-behind-nat:22:localhost:22224

And try to find other tunnels that are open? Or is this also handled somehow in the firewall? I always try to avoid using ports for tunnels if I can avoid it on multi-user systems for this reason. This means using Unix sockets as much as possible for the permissions/security aspects. However, that also means that whatever tool I'm using also has to support Unix sockets. And in your case it would mean letting random people create "file" sockets on a server, which isn't necessarily a good idea.

All port forwarding requests are bind to random localhost ports only. What client writes to the left part of -R command is not used in socket binding process, but saved in forwarding database called "pseudodns". The SSH daemon is customized for this task. When the client tries to connect to such socket, the request is "rewrote" back to real socket port number. Only TCP forwarding is possible, UNIX socket ("streaming") forwarding is not supported.

pretty cool, I build this stuff with containers to reach databases in different locations. This is a really cool simple powerful product for general use.