Show HN: Tunshell – Remote shell into ephemeral environments behind NAT/firewall

  Host i-* mi-*
   ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'"
   UserKnownHostsFile /dev/null
   StrictHostKeyChecking no
   User ubuntu
   LogLevel ERROR
   DynamicForward 5060

Main issue I have with this is the requirement for some binary to establish the shell connection, where you can get by just fine with a bidirectional TCP stream.

I’ve been doing something similar to this for a while, but just by using netcat on an externally routable server. Then, I created a TCP relay server that acts as a link between a TCP connection and WebSocket to replace it [0].

You can use this to open reverse shells over tcp, redirect output to a socket, etc. and it’ll all be available through a browser page.

My personal favorite use is something like: `htop | tee >(nc host port)`, which redirects and prints command output to a web page that you can share with anyone. The beauty of this route over something like Tunshell is that your client implementation decides what to do with the socket and can just treat is as a bidirectional stream. There’s another service that provides similar functionality but doesn’t have the bidirectionality and stores the stream [1].

If you want to use it as a tmate alternative, just write a client that does just that [2]. Now you can control whether or not people can write to your session, share any command, and all your peer needs to access the session is a browser.

I think Tunshell definitely has some cool features (direct connection, multi protocol, small statically linked bin) and I will still likely find a way to use it though!

[0] https://github.com/antoniomika/seeshell

[1] https://seashells.io/

[2] https://github.com/antoniomika/shellshare

Why I asked for this is because tmate isn't really that secure. You have to trust the relay server.

Maybe tunshell can be combined with tmux directly to open a shared view.