Hacker News Reader

Comment by ch0wn | Hacker News Reader

Not to be confused with sshuttle, a transparent proxy server that forwards over SSH: https://github.com/apenwarr/sshuttle

View on HN

This looks pretty sweet. Seems like it'd work well with EC2 for transparently getting you into the private hostnames without having to open security groups and use something like FoxyProxy. Anyone used it for this?

I haven't looked at it all, but it sounds like you're wanting something like the functionality that SSH's "ProxyCommand"?

As an example, we lockdown our servers so that they are only accessible via SSH from a few hosts. I got tired of SSH'ing into server A just to SSH into server B, so I set up my ~/.ssh/config file so that when I "ssh serverB", it uses the ProxyCommand functionality to basically do that for me.

Here's what it looks like in ~.ssh/config:

    Host serverB
        ProxyCommand ssh serverA.example.com -W %h:%p

When I "ssh serverB", it connects to serverA first and then connects to serverB. I could be wrong but it sounds like that is what you were talking about.

Pretty close yeah, except that serverB is only listening on a private IP, and I want to connect to it in by web browser (http). My primary use case is with hadoop clusters, where I access the jobtracker ui on the public hostname, but when I drill down into task logs it points to private/internal IPs. FoxyProxy allows me to access the private IPs directly/transparently, but I do most of my browsing with Chrome these days, so it'd be nice to just be able to do it all in one browser.

ProxyCommand looks pretty cool though, wasn't aware of it - thanks!

> ... except that serverB is only listening on a private IP and I want to connect to it in by web browsing (http) ...

Still possible, with ssh's "-D" option that basically turns a remote SSH server into a (HTTP) proxy server!

    $ ssh -D 4444 serverA.example.com

In your browser (I use a separate browser, permanently configured this way), configure it to use a (SOCKS5) proxy server for all traffic. The proxy server should be "localhost:4444".

In your address bar, navigate to "http://serverB.example.com". The HTTP traffic is sent over the SSH tunnel to serverA and from there it goes out to the network to its destination. To the destination server (serverB), it appears that the request originated from serverA and that's where the response will go (at which point it is again encrypted and sent over the SSH tunnel back to your local machine). Visit http://icanhazip.com (or a similar site), for example, and you'll see that, to the remote web server, it appears that traffic is coming from serverA.

This isn't the most eloquent explanation, sorry. Look into "SSH socks proxy" and you should find much better explanations. It's really much easier than it sounds! =)

Reply on news.ycombinator.com