rss rss hh new
rss_rss_hh_new

 -

rss_rss_hh_new

 - e-mail

 

 -

LiveInternet.ru:
: 17.03.2011
:
:
: 51

:


SSH

, 21 2017 . 18:03 +
SSH , , , , . SSH .

:
1) Local TCP forwarding
2) Remote TCP forwarding
3) TCP forwarding chain
4) TCP forwarding ssh-
5) SSH VPN Tunnel
6)
7) ()


1) Local TCP forwarding


local TCP forwarding:

image

host2 , , PostgreSQL server, TCP- 5432. , , 5432 , SSH (- 22, ). host1 PostgreSQL host2.

host1 :
host1# ssh -L 9999:localhost:5432 host2
host1 PostgreSQL 9999:
host1# psql -h localhost -p 9999 -U postgres
host1 Windows
, PuTTy :
: Connection -> SSH -> Tunnels.
Source port 9999, Destination localhost:5432, Add.
, .
image

SSH- host2, host1 SSH- 9999. 9999 host1, SSH- host2 localhost ( host2) 5432 , ssh- host1 9999.
! TCP- ().

SSH-
Port forwarding, , sshd -.
/etc/ssh/sshd_config:
AllowTcpForwarding yes


host2, :

image

localhost , host3:
host1# ssh -L 9999:host3:5432 host2
, host3 ( , IP-) host2.

host1 ( host1A) host3:

image

ssh IP- , 9999:
ssh -L 0.0.0.0:9999:host3:5432 host2
9999 host1 IPv4 .

2) Remote TCP forwarding


, , , host2 IP-, NAT ? , , host2 Windows SSH-?

Remote TCP forwarding:

image

ssh- host2 host1. .. SSH- SSH host2, host2 SSH-:
ssh -R 9999:localhost:5432 host1

host2 Windows
, PuTTy :
: Connection -> SSH -> Tunnels.
Source port 9999, Destination localhost:5432, Remote, Add.
, .
image

, host1 SSH- 9999. 9999 host1, SSH- host2 localhost ( host2) 5432 , ssh- host1 9999.

host1, host2. .
, , - ( ) ssh- host2 , host1 IP- SSH.

ssh- .

3) TCP forwarding chain


, . .. , host1 -> host2 -> host3 -> host4:
host1# ssh host2
host2# ssh host3
host3# ssh host4
host4# echo hello host4

, .

TCP forwarding :

image

9991, 9992, 9993 , (, 9999), .

:
host1# ssh -L 9991:localhost:9992 host2
host2# ssh -L 9992:localhost:9993 host3
host3# ssh -L 9993:localhost:5432 host4

, :
  • host1: 9991, ssh- 9992 host2;
  • host2: 9992, ssh- 9993 host3;
  • host3: 9993, ssh- 5432 host4;

, 9991 host1, host4 5432.
! TCP- ().


4) TCP forwarding ssh-


ssh , , ssh- (. ).
:

image

host1# ssh -L 2222:localhost:2222 host2
host2# ssh -L 2222:host4:22 host3

, 2222 host1 SSH (22) host4. :

host1# ssh -p 2222 localhost
host4# echo hello host4

, ? , :

# host4
host1# scp -P 2222 /local/path/to/some/file localhost:/path/on/host4
# host4
host1# scp -P 2222 localhost:/path/on/host4 /local/path/to/some/file
# TCP forwarding host4
host1# ssh -p 2222 -L 9999:localhost:5432 localhost
host1# psql -h localhost -p 9999 -U postgres
# , ssh -p ,
# scp -P

, host4 :)

: TCP forwarding .

RSA fingerprint
scp , ssh -p 2222 localhost RSA fingerprint .
(2222) , RSA fingerprint, . ~/.ssh/known_hosts.


5) SSH VPN Tunnel


TCP port forwarding . ? UDP, , ? VPN. SSH 4.3 .

: SSH - . VPN , .. TCP-over-TCP, .
TCP forwarding
TCP port forwarding SSH, , VPN, .. TCP port forwarding , , . : http://blog.backslasher.net/ssh-openvpn-tunneling.html


SSH-:
PermitTunnel sshd - , /etc/ssh/sshd_config:
PermitTunnel yes

PermitTunnel point-to-point

: ssh-, ssh- . , , ssh- :
PermitRootLogin without-password
root , , , RSA, .

sshd:
sudo service sshd restart # centos

/etc/init.d/ssh restart # (debian/ubuntu)

-w:

host1# sudo ssh -w 5:5 root@host2

5:5 .
, ifconfig tun5. down, ifconfig -a ifconfig tun5, :

host1# ifconfig tun5
tun5 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
POINTOPOINT NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

IP- :
host1# sudo ifconfig tun5 192.168.150.101/24 pointopoint 192.168.150.102
host2# sudo ifconfig tun5 192.168.150.102/24 pointopoint 192.168.150.101

, tun5:
host1# #
host1# sudo iptables-save > /tmp/iptables.rules.orig
host1# sudo iptables -I INPUT 1 -i tun5 -j ACCEPT
host2# #
host2# sudo iptables-save > /tmp/iptables.rules.orig
host2# sudo iptables -I INPUT 1 -i tun5 -j ACCEPT
host1 , ping .

:
host1# ping 192.168.150.102
host2# ping 192.168.150.101

PostgreSQL, :

image

PostgreSQL :

host1# psql -h 192.168.150.102 -U postgres

- , , . :

host2# # IP forwarding
host2# sudo sysctl -w net.ipv4.ip_forward=1
host2# # IP forwarding host1
host2# sudo iptables -I FORWARD 1 -s 192.168.150.101 -j ACCEPT
host2# # IP forwarding host1
host2# sudo iptables -I FORWARD 1 -d 192.168.150.101 -j ACCEPT
host2# # IP host1
host2# sudo iptables -t nat -A POSTROUTING -s 192.168.150.101 -j MASQUERADE

host1# # , host2 192.168.2.x, host1
host1# # host2 192.168.2.x
host1# sudo ip route add 192.168.2.0/24 via 192.168.150.2
host1# # host1
host1# ping 192.168.2.1

net.ipv4.ip_forward .
host1# sudo iptables-restore < /tmp/iptables.rules.orig
host2# sudo iptables-restore < /tmp/iptables.rules.orig

, , , ssh- ssh-. , . , .

, ssh host1 host2, host3, host4. TCP forwarding ssh ( host1 host4, ):

host1# ssh -L 2222:localhost:2222 host2
host2# ssh -L 2222:host4:22 host3

, host4 tun5:

host1# sudo ssh -p 2222 -w 5:5 root@localhost
host1# # host4 : sudo ssh -w 5:5 root@host4
host1# sudo ifconfig tun5 192.168.150.101/24 pointopoint 192.168.150.102
host4# sudo ifconfig tun5 192.168.150.102/24 pointopoint 192.168.150.101

host4, :
host4# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.150.0 0.0.0.0 255.255.255.0 U 0 0 0 tun5
192.168.56.0 0.0.0.0 255.255.255.0 U 1 0 0 eth0
0.0.0.0 192.168.56.254 0.0.0.0 UG 0 0 0 eth0

! - tun5 192.168.150.101, . , , -. , , - (0.0.0.0/0) , . , ssh- -.

, 192.168.56.0/24 ssh- host3 IP- .

- -:
host4# route -n > routes.orig

host1 host4:

host1# # IP forwarding
host1# sudo sysctl -w net.ipv4.ip_forward=1
host1# #
host1# sudo iptables-save > /tmp/iptables.rules.orig
host1# # IP forwarding host4
host1# sudo iptables -I FORWARD 1 -s 192.168.150.102 -j ACCEPT
host1# # IP forwarding host4
host1# sudo iptables -I FORWARD 1 -d 192.168.150.102 -j ACCEPT
host1# # IP host4
host1# sudo iptables -t nat -A POSTROUTING -s 192.168.150.102 -j MASQUERADE

- host4 (, . !):

host4# sudo ip route replace default via 192.168.150.101
host4# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.150.0 0.0.0.0 255.255.255.0 U 0 0 0 tun5
192.168.56.0 0.0.0.0 255.255.255.0 U 1 0 0 eth0
0.0.0.0 192.168.150.101 0.0.0.0 UG 0 0 0 tun5

, :

host4# ping 8.8.8.8

. DNS. , /etc/resolv.conf :

nameserver 8.8.8.8
nameserver 8.8.4.4

:

host4# ping ya.ru

:

host1# # host1
host1# sudo iptables-restore < /tmp/iptables.rules.orig
host1# # net.ipv4.ip_forward

host2# # - host4:
host2# sudo ip route replace default via 192.168.56.254
host2# # DNS- /etc/resolv.conf


6)


, . RSA:

1. RSA:
client1# ssh-keygen -t rsa
- ~/.ssh/id_rsa, ~/.ssh/id_rsa.pub. , .
(passphrase), .

2. ssh- ~/.ssh/authorized_keys (~ , ), . , :
ssh-copy-id user@sshserver
user , sshserver IP- ssh-.

3. , , ( passphrase):
ssh user@sshserver
ssh- , .

4. SSH- /etc/ssh/sshd_config:
PasswordAuthentication no
-:
PubkeyAuthentication yes
:
GSSAPIAuthentication no
UseDNS no
(, ).

5. sshd:
service sshd restart>

/etc/init.d/ssh restart

7) ()


help.ubuntu.com/community/SSH_VPN
habrahabr.ru/post/87197
blog.backslasher.net/ssh-openvpn-tunneling.html
Original source: habrahabr.ru (comments, light).

https://habrahabr.ru/post/331348/

:  

— — : [1] []
 

:
: 

: ( )

:

  URL