I have 3 computers 2 Linux and 1 Windows.
Windows PC and Linux server (A) are on the same network (1).
The linux server (B) is on another network (2).
I want to make an SSH tunnel between the 2 linux servers to allow the Windows PC to access an HTTP page of the Linux server (B), which is therefore on another network.
With this command on the linux server (A) the tunnel works fine but only locally in linux.
ssh -R 8080:localhost:80 linuxa.internet.com
But from Windows PC I cannot access port 8080 on linux (A). http://linuxa.local:8080 does not work.
So I tried these two commands to open access to my PC but it doesn't work either.
ssh -R 0.0.0.0:8080:localhost:80 linuxa.internet.com
ssh -R ipwindows:8080:localhost:80 linuxa.internet.com
Can you help me ?
Thank you
From a comment, I conclude that you might have problem with the firewall. Suppose you can reach the tunnel from the host that is "proxy" (with curl,wget,ncat etc. on localhost). You should check what block traffic. In most cases, it is a firewall. Depending on your Linux distro you might have different backends and frontends for a firewall. If you have firewall-cmd command installed it's very likely that firewalld is one.
But before blaming the firewall, you should check if a port is open/closed. I prefer netcat:
HOST_THAT_SHOULD_HAVE_OPEN_PORT # nc -l 8080
HOST_THAT_SHOULD_BE_ABLE_TO_CONNECT # nc HOST_THAT_SHOULD_HAVE_OPEN_PORT 8080
If there is no connection or connection is refused, it's extremely likely that the firewall is the problem.
You can check if firewalld is running with systemctl:
# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2021-02-08 21:42:29 CET; 13h ago
Then you might add traffic on port 8080:
# firewall-cmd --add-port 8080/tcp
success
It will temporarily open network traffic on 8080. Then you should be able to use port 8080 and your ssh tunnel.
Thank you for your answer but I don't think I have a firewall installed
systemctl status firewalld
return
Unit firewalld.service could not be found.
and
firewall-cmd --add-port 8080/tcp
-bash: firewall-cmd: command not found
Related
Currently, I have built a small datacenter environment in OTC with Terraform. based on Ubuntu 20.04 images.
The idea is to have a jump host in the setup phase and for operational purposes that allows spontaneous access to service frontends via ssh proxy jumps without permanently routing them to the public net.
Basic setup works fine so far - I can access the jump host with ssh, and can access the internal machines from there with ssh when I put the private key onto the jump host. So, cloudwise the security seems to be fine. Key pair is generated with ed25519, I use the same key for jump host and internal servers (for now).
What I cannot achieve is the proxy jump as a chained command from my outside machine.
On the jump host, I set AllowTcpForwarding to "yes" in /etc/ssh/sshd_config and restarted ssh and sshd services.
My current local ssh config looks like this:
Host otc
User ubuntu
Hostname <FloatingIP-Address>
Port 22
StrictHostKeyChecking=no
UserKnownHostsFile=/dev/null
IdentityFile= ~/.ssh/ssh_access
ControlPath ~/.ssh/cm-%r#%h:%p
ControlMaster auto
ControlPersist 10m
Host 10.*
User ubuntu
Port 22
IdentityFile=~/.ssh/ssh_access
ProxyJump otc
StrictHostKeyChecking=no
UserKnownHostsFile=/dev/null
I can use this to ssh otc to the jump host.
What I would expect is that I could use e.g. ssh 10.0.0.56 to reach an internal host without further ado. As well I should be able to use commands like ssh -L 8080:10.0.0.56:8080 10.0.0.56 -N to map an internal server's port to a localhost port on my external machine. This is how I managed that successfully on other hosting scenarios in the public cloud.
All I get is:
Stdio forwarding request failed: Session open refused by peer
kex_exchange_identification: Connection closed by remote host
Journal on the Jump host says:
Jul 30 07:19:04 dev-nc-o-bastion sshd[2176]: refused local port forward: originator 127.0.0.1 port 65535, target 10.0.0.56 port 22
What I checked as well:
ufw is off on the Jump Host.
replaced ProxyJump configuration with ProxyCommand
So I am at the end of my knowledge. Has anyone a hint what else could be the reason? Any help welcome!
Ok, cause is found (but not yet fully explained).
My local ssh setting was allowing multiplexed forwards (ControlMaster auto ) which caused the creation of a unix socket file for the Controlpath in ~/.ssh.
I had to login to the jump host to AllowTcpForwarding in the first place.
After rebooting the sshd, I returned to the local machine and the failure occured when trying to forward to the remote internal machine.
After deleting the socket file in ~/.ssh, the connection can now be established as needed. Obviously, the persistent tunnel was not impacted by the restarted daemon on the jump host and simply refused to follow the new directive.
This cost me two days. On the bright side, I learned a lot about ssh :o
I have a windows PC
I have installed Ubuntu server on my Vmware and switched to Bridge Network
Now I installed webmin
sudo service webmin start
with ssl=1
also done this
sudo iptables -A INPUT -p tcp -d 0/0 -s 0/0 --dport 10000 -j ACCEPT
I can access webmin from my computer and on my LAN
also via browser on any device on my wifi https://192.168.187.129:10000/
But I cannot access this from outside network
But i cannot use this outside of my lan.
I can connect with ssh on my lan only
also done sudo ufw allow 10000
No answer on this
https://superuser.com/questions/1122496/cant-acces-webmin-outside-the-virtual-machine-running-it-virtualbox-ubuntu-s
Enable port forwarding on your router. 192.168 is reserved for internal networks and cannot be routed across the Internet. Your router will have it's on external IP address and you will need to enable port forwarding so that when you hit externalIP:10000 it gets forwarded to 192.168.187.129:10000.
Of course, this will mean that Webmin is exposed to anyone on the Internet who wants to try to log in, so make sure you set strong passwords. You may want to consider locking it down so that only a subset of external IP's can connect as well.
I recently started using docker toolbox on windows and its been quite a hard experience. A lot of things are different compared to running docker on linux as here docker is actually running inside virtual machine.
one of the issues i was still not able to resolve is how to create reverse ssh tunnel to my docker-toolbox VM and bind it to 0.0.0.0 (or to docker0 interface)
i have docker toolbox 1.10.2 and am running windows 7.
motivation: I have mysql server running on my windows machine and i would like to connect to it from my docker containers.
problem: i first tried connecting directly to 192.168.99.1 (the ip of my host windows box inside my containers) ... however that doesnt work. i think the reason is that my windows box is blocking all external connections to it. i cant change windows firewall settings as those are managed by domain.
workaround: i setup ssh connection to my VM (boot2docker inside virtualbox) with putty and i try to setup reverse proxy:
i check the "Remote ports do the same" under SSH tunnels in putty
source port i enter 0.0.0.0:3306
destination i enter localhost:3306
i check "remote" radio button
i then ssh to boot2docker ... netstat -natp | grep 3306 shows me its actually bound to 127.0.0.1
i opened /usr/local/etc/ssh/sshd_config
i set GatewayPorts yes
i restard sshd with /usr/local/etc/init.d/openssh restart
i get disconnected ... when i create new connection and netstat -natp | grep 3306 i see 3306 is still bound to 127.0.0.1 only
same settings in putty (and in sshd_config) work on my debian box ... but not inside boot2docker.
any idea whats wrong ? thanks a lot.
I am connecting to CentOS7 minimal installation machine in a LAN (192.168.1.33).
I have changed the ssh port vi /etc/ssh/sshd_config line 17 Port 1234
after restarting the sshd service the connection is refused
ssh demo#192.168.1.33 -p 1234
ssh: connect to host 192.168.1.33 port 1234: Connection refused
I have disabled SELinux and router-firewall but still having problem.
Though if I change back to port 22 I can login again.
Is there any other configuration to be changed?
Can you remotely connect to the server another way? If so, once you get in, run sudo netstat -plutn.
You should see at least one entry for sshd. If you don't, sshd isn't running. You can install it via sudo apt-get install openssh-server.
If you do, is the port under 'Local Address' for the sshd line 1234? This will tell you if you successfully changed the port configuration.
Hope that helps!
I am not able to access Amazon EC2 instance via ssh as i am behind a firewall.
So, i thought of running ssh on port other than 22, like 80 or 443.
I tried starting Amazon EC2 instance via Web Management Console with following 'user data':
#!/bin/bash -ex
perl -pi -e 's/^#?Port 22$/Port 80/' /etc/ssh/sshd_config
service sshd restart || service ssh restart
The idea being that the above script would execute on instance startup and switch ssh from port 22 to port 80. (Ref: http://alestic.com/2010/12/ec2-ssh-port-80)
But ssh is still not accessible on port 80.
Apparently 'user data' script is not being executed on start up?
I can 'only' start stop instances via Web Management Console, not from command-line (being behind firewall)
Any ideas?
To connect to an AWS instance through ssh from a port different than default 22:
Open the security group of your instance so that it allows connections to that port from the source that you choose (0.0.0.0/0 for any source).
In your instance:
It is a new instance you could use an user-data script like this one:
#!/bin/bash -ex
perl -pi -e 's/^#?Port 22$/Port 443/' /etc/ssh/sshd_config
service sshd restart || service ssh restart
Please note that this only works if you are launching a new instance:
User data scripts and cloud-init directives only run during the first boot cycle when an instance is launched.
If it is not a new Instance, edit the /etc/ssh/sshd_config file adding/changing Port 22 to the port that you want (i.e: Port 443) to connect through ssh and then do service ssh restart and you should be done.
Note: I did this with an Ubuntu instance, with another Linux instances may be slightly different.
The amazon firewall blocks all ports other than 22. You first have to enable port 80/443/whatever.
HOWTO:
Go to "security groups" -> click on the group you chose for your instance, then on the "Inbound" tab.
There you can add your ports.
EDIT: If by chance you also installed apache or some other webserver, port 80 will be used and cannot be used by sshd. I do not know which operating system is installed on your server, but maybe some webserver is already included?
EDIT 2: As per the last comment, it seems nowadays all ports are blocked by default. So you will have to open port 22 if you need it. Wasn't the case eight years ago, but configurations change ;)
Here is what I came up with to run sshd on 443 and 22 having rhel8 on ec2
make sure your security groups allow connection from your network/ip to the desired ports (in my case 22 and 443)
tcp 443 1.2.3.4/32 #allow access to 443 from IP 1.2.3.4
tcp 22 1.2.3.4/32 #allow access to 22 from IP 1.2.3.4
Login to the EC2 and
#install semanage with
sudo yum install -y policycoreutils-python-utils
#delete 443 from http ports
sudo semanage port -d -t http_port_t -p tcp 443
#add 443 to ssh ports
sudo semanage port -m -t ssh_port_t -p tcp 443
Edit /etc/ssh/sshd_config
Port 22
Port 443
Restart sshd
sudo service sshd restart