Geek Question - SSH port forwarding Question

[crokett]

I am looking for something a skosh more secure than simply opening up my router for the Windows remote desktop port to be able to remote in to my home machine. I know I can tunnel via ssh. I have an ssh server installed on my linux box. Rather than install another on my XP machine, can I tunnel into the Linux box and forward the windows remote desktop port to the XP machine?

[pierhogunn]

I am sure you can, and I was about to tell you how, but I went to reach for that file in my head labeled port forwarding and tunneling, and sadly all that was in the file was an old copy of a batman comic...


had you asked the question about 1 year ago, ...

[crokett]

Thanks, I will find put the how. I am getting lazy in my dotage and don't want to expend the energy to try to find out how to do something that can't be done.

[thrytis]

Yes, it shouldn't be a problem providing the remote desktop is just a simple tcp session. I believe the syntax for OpenSSH is something like 'ssh -L <port to connect your client on>:<remote windows address>:<remote desktop port> <linux user>@<linux address>'. Since you are coming from a Windows client, you'll need to look for the equivalent settings.

[crokett]

Eric,

I've done something like that before and may be complicating things but I want my linux box (the ssh server) to forward the remote desktop traffic to the windows machine. Don't I have to tell the linux ssh server what traffic to forward? Or does the command syntax you listed tell the server to do that? I played with tunneling a while back but that was for samba and the shares were on the same machine that was the ssh server.

[thrytis]

Let me make sure i understand what you are trying to do. You have:

• Machine A: windows machine that you are in front of and want to view the remote desktop on
• Machine B: Linux machine you want to go through
• Machine C: Windows machine you want to access

The client for viewing the remote desktop opens a TCP connection from the client machine to the remote machine.

Is that correct?

If so, then you would start your SSH client on A connecting to B. You specify the port forwarding, listening on the local machine A, connecting to machine C (OpenSSH argument '-L <Port A>:<Address C>:<Port C>'). Port C is the port that the remote desktop on C listens on. You then start your remote desktop client with the destination localhost, port A. SSH will create a tunnel between localhost, port A to B to C, port C. The client looks like it is pointing to localhost, the remote desktop sees the connection coming from B. The connection between A and B will be encrypted, but B to C will not.

When connecting with the client, make sure you use localhost and not the LAN interface, as SSH won't forward connections from the LAN interface by default.

[rjwaldren]

I assume you are looking at getting in from outside the network. What are you using as a firewall. If it's linux based look into "port knocking" and use non-standard ports on the WAN side of your router.

Port Knocking allows you to set up a sequence that your router will listen for. Once recieved it can excecute a script to do anything you want (apply firewall rules, open ports, WOL, setup tunnels or whatever.) I use it to enable port forwards on a DD-WRT firmware based Linksys router, but it would be easier to set up if a linux PC is managing your traffic. I only use it to open ports for direct access to the machine/service I want - I didn't want to over complicate things any further. I map all standard ports to ports >50000 for access from the WAN. On the LAN side everything is normal.

[tseavoy]

I don't understand a word you guys are saying.

Tom

POLITICS, n. A strife of interests masquerading as a contest of principles.

[crokett]

I assume you are looking at getting in from outside the network. What are you using as a firewall. If it's linux based look into "port knocking" and use non-standard ports on the WAN side of your router.

Yes I am looking at getting in from outside. I am using a Netgear router. I have no idea if it can run scripts but I think not. I would be surprised if it could.

Thrytis's post sounds like the answer and I will play with it. I've already tunneled some things via ssh but that was back to the same machine the ssh server is on.

[rjwaldren]

Look into possible third party firmware for your netgear router... DD-WRT, OpenWRT, Tomato firmware are available more many brands but it depends on the chipsets that they use.

I agree with the tunneling approach likely being what you want. I was thinking of ways to automate it. The particular firmware I'm using has openssh and openvpn servers included as well as samba and DynamicDNS. I added portknockd and use it to expose the ports to the outside and create the tunnels when I need them.

I've moved most of my servers to the router so they aren't dependent on PC being powered on, in fact WOL will wake the correct PC for me if it's off.

[yamato72]

You can't beat PuTTY

http://www.chiark.greenend.org.uk/~s.../download.html


Instructions:

http://realprogrammers.com/how_to/se...ith_putty.html

[crokett]

I got it working but it took a bit of swizzling. First I was getting a bind error trying to establish the tunnel so I disabled allowing users to connect to this machine. Not ideal, but ok for testing. Then I could set up the tunnel but when I did that and tried to connect to localhost I was told I was already logged into the local console. So... I had to find the registry entry to change the port that Remote desktop connection listens on and that worked. Now when I want to remote to this machine I just need to remember what port it is...

[dabeeler]

Try FreeNX. Uses keys for security. Works pretty well.

[rjwaldren]

I thought about freeNX but having any ports open is the first security risk to take care of... FreeNX performance is impressive though.

[crokett]

It looks like FreeNX is only available for Linux? In any case we are not all there yet. I was not able to establish the tunnel (bind errors on Windows) until I changed the port on my laptop that Remote Desktop listens on (registry entry). Of course when I did that it breaks connecting to Remote Desktop on the laptop because the Remote desktop client is not too bright and doesn't appear to have the ability to connect to any other port than the default. So I can't control this machine which is not acceptable. I have a desktop at work that I use when in the office and I remote into my laptop as needed during the day.

Right now I am thinking about something like VNC and tunneling to that but I'd rather not install 3rd party SW if I don't have to.