SFTP, SSH & SSH Tunneling

Question

I would like to understand the concept of SSH tunneling in detail as I am learning a few things around this topic. I have gone through some details in public forum but still

Answer 1

SSH tunneling, SSH console sessions and SFTP sessions are functionally unrelated things. They can be used simultaneously during single session but usually it is not the case so do not try to find any relation or role of tunneling in ssh/sftp session.

It does not makes sense to mix ssh tunneling with multiple ssh/sftp sessions. Basically you would use dedicated ssh session for tunneling and extra sessions for console and transfers.

What the heck SSH tunneling is?

Quite often both parties (you and server) reside in different networks where arbitrary network connections between such networks are impossible.

For example server can see on its network workstation nodes and service nodes which are not visible to outside network due to NAT.

The same is valid for the user who initiates connection to the remote server: so you (ssh client) can see your local resources (worstation nodes and server nodes) but can't see nodes on network of remote server.

Here comes ssh tunneling.

SSH tunnel is NOT a tool to assist ssh related things like remote console ssh sessions and secure file transfers but quite other way around - it is ssh protocol who assists you with building transport to tunnel generic TCP connections the same way TCP proxy works. Once such pipe is built and in action it does not know what is getting transferred via such pipe/tunnel.

Its concept is similar to TCP proxy.

TCP proxy runs on single node so it serves as acceptor of connections and as iniciator of outgoing connections.

In case of SSH tunneling such concept of TCP proxy is split in two halves - one of the nodes (participating in ssh session) performs role of listener(acceptor of connections) and second node performs role of proxy (i.e. initiates outgoing connections).

When you establish the SSH session to the remote server you can configure two types of tunnels which are active while your ssh connection is active. Multiple ssh clients use notations like

• R [IP1 :] PORT1 : IP2 : PORT2
• L [IP1 :] PORT1 : IP2 : PORT2

The most confusing/hard part to understand in this ssh tunneling thing are these L and R markers/switches(or whatever).

Those letter L and R can confuse beginners quite a lot because there are actually 6(!!!) parties in this game(each with its own point of view of what is local and what is remote):

1. you
2. ssh server
3. your neighbors who want to expose theirs ports to anyone who sees the server
4. your neighbors who want to connect to any service server sees
5. anyone who sees the server and want to connect to any service your neighbor provides (opposite side/socket of case #3)
6. any service in a local network of server who wants to be exposed to your LAN (opposite side/socket of case#4)

In terms of ssh client these tunnel types are:

• "R" tunnel (server listens) - YOU expose network services from your LOCAL LAN to remote LAN (you instruct sshd server to start listening ports at remote side and route all incoming connections )
• "L" tunnel (you listens) - Server exposes resources of its REMOTE LAN to your LAN (your ssh client starts listening ports on your workstation. your neighbors can access remote server network services by connecting to the ports of your workstation. server makes outgoing connections to local services on behalf of your ssh client)

So SSH tunneling is about providing access to the service which typically is inaccessible due to network restrictions or limitations.

And here is simple conter-intuitive rule to remember while creating tunnels:

• to open access to Remote service you use -L switch

and

• to open access to Local service you use -R switch

examples of "R" tunnels:

Jack is your coworker(backend developer) and he develops server-side code at his workstation with IP address 10.12.13.14. You are team lead (or sysadmin) who organizes working conditions. You are sitting in the same office with Jack and want to expose his web server to outside world through remote server. So you connect to ssh server with following command:

 ssh me@server1 -g -R 80:ip-address-of-jack-workstation:80

in such case anyone on the Internet can access Jack's current version of website by visiting http://server1/

Suppose there are many IoT Linux devices (like raspberry pi) in the world sitting in multiple home networks and thus not accessible from outside. They could connect to the home server and expose theirs own port 22 to the server for admin to be able to connect to all those servers. So RPi devices could connect to the server in a such way: RPi device #1

ssh rpi1@server -R 10122:localhost:22

RPi device #2

ssh rpi1@server -R 10222:localhost:22

RPi device #3

ssh rpi1@server -R 10322:localhost:22

and sysadmin while being at server could connect to any of them:

ssh localhost -p 10122 # to connecto first device
ssh localhost -p 10222 # to connecto second device
ssh localhost -p 10322 # to connecto third device

admin on remote premises blocked ssh outgoing connections and you want production server to contact bitbucket through your connection...

#TODO: add example

Typical pitfalls in ssh tunneling:

mapping remote service to local priviledged port

ssh me@server -L 123:hidden-smtp-server:25 # fails
#bind fails due to priviledged ports
#we try to use sudo ssh to allow ssh client to bind to local port switches

sudo ssh me@server -L 123:hidden-smtp-server:25 # fails
#this usually results to rejected public keys because ssh looks for the key in /root/.ssh/id_rsa
#so you need to coerce ssh to use your key while running under root account

sudo ssh me@server -i /home/me/.ssh/id_rsa -L 123:hidden-smtp-server:25

exposing some service from local network to anyone through the public server:

typical command would be

ssh me@server -R 8888:my-home-server:80
#quite often noone can't connect to server:8888 because sshd binds to localhost.
#To make in work you need to edit /etc/ssh/sshd_config  file to enable GatewayPorts (the line in file needs to be GatewayPorts yes).

my tunnel works great on my computer for me only but I would like my coworkers to access my tunnel as well

typical working command you start with would be

ssh me@server  -L 1234:hidden-smtp-server:25
#by default ssh binds to loopback(127.0.0.1) and that is the reason why noone can use such tunnel.
#you need to use switch -g and probably manually specify bind interface:
ssh me@server  -g -L 0.0.0.0:1234:hidden-smtp-server:25