3 ms·

Very neat, but SSH already has capabilities built-in to handle this scenario without harming security or increasing complexity. To add to irq-1's excellent res

Very neat, but SSH already has capabilities built-in to handle this scenario without harming security or increasing complexity. To add to irq-1's excellent response, another autossh method is to autossh from the device into a remote relay server (ie jumpbox) that forwards the local port back to the local ssh server running on the device, which can now be listening on localhost. You can try this out in literally ONE COMMAND LINE (below) and automate it quickly without installing any additional software (except perhaps autossh, which is usually in your distribution's repositories). device (autossh) -> jumpbox <- you You can also use Userify (https://userify.com https://userify.com) or similar to keep keys synchronized on the device and jumpbox in this scenario. (Userify only needs outbound https.) Use RemoteForward (-R) on the autossh command line for this. See man page for ssh(1) and especially the RemoteForward section under ssh_config(5) for details. Example: # on the device: $ ssh jumpbox -R 22001:localhost:22 Now you can just log into the jumpbox on port 22001 using SSH's built-in tun support (-w) in your SSH client (or forward your agent by passing -A when logging into the jumpbox, but this could be hijacked by an attacker who'd compromised the jumpbox, so do -w instead.) That's all. You can automate this with ssh_config, autossh, etc, and also lock down the remote host authorized_keys file and use a restricted shell.

jamiesonbecker 9y ago
Additional details: You have to log into jumpbox (presumably still running on port 22) in order to log into the device who's SSH listening port has been forwarded from port 22 on the device itself across the encrypted tunnel to port 22001 on the localhost of the jumpbox. If instead you prefer to expose the 22001 to the entire world (so you don't need to log into the jumpbox first), try this: device$ ssh jumpbox -R 22001:*:22 Then, to log into the device, you can just laptop$ ssh jumpbox -p 22001 which will pass your encrypted packets securely through from your laptop to the end device (and the jumpbox can NOT see them.) Keep in mind that, with this method, any potential attacker can now directly try to break into the device itself through the jumpbox rather than have to break into the jumpbox first, so make sure that you harden both the jumpbox and the end device (which is always a good idea anyway - don't deploy an IOT device that isn't hardened!)

jamiesonbecker 9y ago

Additional details: You have to log into jumpbox (presumably still running on port 22) in order to log into the device who's SSH listening port has been forwarded from port 22 on the device itself across the encrypted tunnel to port 22001 on the localhost of the jumpbox. If instead you prefer to expose the 22001 to the entire world (so you don't need to log into the jumpbox first), try this: device$ ssh jumpbox -R 22001:*:22 Then, to log into the device, you can just laptop$ ssh jumpbox -p 22001 which will pass your encrypted packets securely through from your laptop to the end device (and the jumpbox can NOT see them.) Keep in mind that, with this method, any potential attacker can now directly try to break into the device itself through the jumpbox rather than have to break into the jumpbox first, so make sure that you harden both the jumpbox and the end device (which is always a good idea anyway - don't deploy an IOT device that isn't hardened!)