Guide: ssh reverse tunneling with public key protection
This short guide is supposed to reflect one possible way of setting up a ssh reverse tunnel including protection trough private key.
The use case is that you (as an advisor) want to help someone else via the internet without having your user configuring his router (dsl connection expected as condition).
As a result, the user only needs to execute the command you send via email in a console (this guide only takes care of Linux at first).
I assume that you (as you follow my description) have local control of both machines (not necessary at the same time).
Additionaly I won’t create different key pairs for the HOST and the CLIENT.
I will add this to the guide on time, for now I expect you trust the user so far (also you just can block port forwarding on your router anyway).
In my further explanation, the CLIENT will be the machine of the user that needs help, where the HOST is the machine that you (or any other advisor) uses.
So here is the agenda of what to do in the order I did it.
Some steps depend on others but some don’t. I’ve tried to mention links as they approach.
These steps have to be done on both machines (due to the fact that you have two single connections).
1. Install SSH-client and -server
# USERNAME@MACHINE:~$ sudo aptitude install openssh-client openssh-server
2. Change ssh-server configuration using your preferred editor (I used pico because it’s gui)
# USERNAME@MACHINE:~$ sudo pico /etc/ssh/sshd_config
a) Set port for incoming ssh connection (default is 22) to a custom value between 10000 and 32000.
In this scenario use the same internal port for both CLIENT and SERVER)
Port 22 -> Port XXXXX
b) Deny root login
PermitRootLogin yes -> no
c) Deny login via password authentication
PasswordAuthentication yes -> no
d) Activate and set path+filename for public key (id_rsa.pub)
Note: the file “authorized_keys” is supposed to contain ALL public keys you need to have.
To make it easier in our case, and because we will use the same keys on both machines, I renamed it to id_rsa.pub (the name of the key by default)
#AuthorizedKeysFile %h/.ssh/authorized_keys -> AuthorizedKeysFile %h/.ssh/id_rsa.pub
3. Generate key pair (private and public key) in default folder (/home/USERNAME/.ssh)
The command generates the key pair (id_rsa / id_rsa.pub) if you use the default.
# USERNAME@MACHINE:~$ ssh-keygen -t rsa
At this point you should be able to establish a connection from CLIENT to HOST and the other way round.
This is highly recommended also to proof the finger-print of both machines and make them known to each other.
4. Connect CLIENT to HOST and the other way round
# USERNAME@MACHINE:~$ ssh USERNAMEHOST@HOSTNAME -p XXXXX
# USERNAME@MACHINE:~$ ssh USERNAMECLIENT@CLIENTNAME -p XXXXX
Now we have reached an important point of the setup. If this works out, HOST and CLIENT are known to each other and able to connect in via ssh using public key protection.
In any case of an error take a look at the logfile.
# USERNAME@MACHINE:~$ less /var/log/auth.log
You might need get back to the logfile at any time you connection doesn’t work.
Expecting the connection works both ways, we are don with the client expect that you shoud make sure the user can easily access the console to execute the command you will lateron send him (if he needs your help).
I usually set the key-shortcut for a new console to CRTL+ALT+T to make it easy, but placing a shortcut on the desktop or to any panel will also be fine.
The following steps are to be done when you are asked for assistance.
Especially the port forwarding should be deactivated after your work is done because of security reasons.
5. Find out your external IP address using web sites like www.what-is-my-ip.com.
Command to automatically read IP from one of these sites using grep will follow soon.
6. Set port forwarding to route external port XXXXX to internal port XXXXX.
For security set up the route to the fixed internal IP you machine uses and deactivate the route as soon as you’re done.
7. Create command to setup reverse tunnel for execution on your users machine (CLIENT).
The syntax uses another port for the reverse connection shown as YYYYY. Again, any port between 10000 and 32000 (execpt XXXXX).
Send this line (ideally in an encrypted email – it contains your username!) to your user and ask him to execute this command.
ssh -R YYYYY:localhost:XXXXX USERSERVER@PUBLICIPSERVER -p XXXXX
[PUBLICIPSERVER is your external (public) IP]
8. Connect the SERVER to the CLIENT using the reverse route on port YYYYY.
ssh USERCLIENT@localhost -p YYYYY
Now you should be able to have console access to you users machine. Easily check this running e.g. and df -h command.