{"id":515,"date":"2014-11-25T09:12:05","date_gmt":"2014-11-25T09:12:05","guid":{"rendered":"http:\/\/josephpcohen.com\/w\/?p=515"},"modified":"2014-11-25T23:57:33","modified_gmt":"2014-11-25T23:57:33","slug":"ssh-behind-firewall-using-simple-ncat-proxy","status":"publish","type":"post","link":"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/","title":{"rendered":"SSH behind firewall using simple ncat proxy and unmodified intermediary server"},"content":{"rendered":"<p>Sometimes we want to SSH to machines that are behind restrictive firewalls or just because the IP keeps changing. Here I discuss a way to proxy using any publicly accessible SSH server without modification to proxy between two machines that are not directly accessible. For example you can SSH from your laptop in a coffee shop to your home machine which has a dynamic IP or your work machine which is behind a firewall.<br \/>\n<!--more--><br \/>\nSolutions exist for making the connection but they use other peoples servers like Google or TeamViewer and most likely don&#8217;t work with SSH. There are also some systems such a puppet and chef that will allow controlling machines but not realtime like SSH and also require special code on servers. It&#8217;s desired to preserve the beauty of SCP for copying files and SSH (-D or -L) port forwarding so elegantly on the command line. Trying to write something special to do this is not necessary because:<\/p>\n<p><center><\/p>\n<h2>We can just script it with ncat!<\/h2>\n<p><\/center><\/p>\n<p><a href=\"http:\/\/josephpcohen.com\/w\/wp-content\/uploads\/2014\/11\/sshproxy.png\"><img decoding=\"async\" src=\"http:\/\/josephpcohen.com\/w\/wp-content\/uploads\/2014\/11\/sshproxy.png\" alt=\"sshproxy\" class=\"aligncenter size-full wp-image-520\" \/><\/a><br \/>\n<center><br \/>\n<script type=\"text\/javascript\">\ngoogle_ad_client = \"ca-pub-2068283315745938\"; \/* give mobile 2 *\/ \ngoogle_ad_slot = \"2166399243\"; \ngoogle_ad_width = 360; \ngoogle_ad_height = 50;\n<\/script><br \/>\n<script type=\"text\/javascript\" \nsrc=\"\/\/pagead2.googlesyndication.com\/pagead\/show_ads.js\">\n<\/script><br \/>\n<\/center><\/p>\n<p>So lets talk about the setup for this to work. <\/p>\n<ul>\n<li>The intermediary server that can connect to both. You do not need to modify the intermediary server or leave anything running on this machine but you must be able to listen on at least one port. You need to dedicate a port per SSH server. The server only needs <code>nc<\/code> or <code>ncat<\/code> to listen and <code>pkill<\/code> to remove old connections. It&#8217;s better to expect <code>nc<\/code> because <code>ncat<\/code> is almost ever installed.\n<li>The SSH server needs a crontab entry installed (or something similar) that connects to the intermediary on a port by status polling to see if a user is trying to connect. Having the SSH server status poll instead of some more sophisticated method makes everything less prone to break. It needs <code>ncat<\/code> to connect to the intermediary and then execute and relay an SSH connection.\n<li>The SSH client only needs to handle the ProxyCommand option. Which is almost all SSH clients.\n<\/ul>\n<p>On the SSH server enter the following crontab entry. Here ever minute <code>ncat<\/code> connects to the intermediary server port 12300. If there is no socket listening then it will exit. If there is a socket listening it will launch another <code>ncat<\/code> process and connect to the local SSH server. Use the full path for <code>ncat<\/code> both times, you can look it up by running <code>which ncat<\/code>. The &#8220;2> \/dev\/null&#8221; is just to prevent emails every minute when the server connection is rejected.<\/p>\n<pre>\r\n<strong>crontab -e<\/strong>\r\n\r\n* * * * * \/usr\/bin\/ncat intermediary 12300 -e '\/usr\/bin\/ncat localhost 22' 2> \/dev\/null\r\n<\/pre>\n<p><center><br \/>\n<script type=\"text\/javascript\">\ngoogle_ad_client = \"ca-pub-2068283315745938\"; \/* give mobile 2 *\/ \ngoogle_ad_slot = \"2166399243\"; \ngoogle_ad_width = 360; \ngoogle_ad_height = 50;\n<\/script><br \/>\n<script type=\"text\/javascript\" \nsrc=\"\/\/pagead2.googlesyndication.com\/pagead\/show_ads.js\">\n<\/script><br \/>\n<\/center><\/p>\n<p>To setup the SSH Client edit the file <em>~\/.ssh\/config<\/em> file to add some Host entries. Each entry runs during the SSH session automatically. Here we SSH to the intermediary server and clean out any old sessions using <code>pkill<\/code> by searching for the exact (-x) match (-f) of the string &#8220;nc -l 12300&#8221; which is what well will launch next. &#8220;nc -l 12300&#8221; starts listening on port 12300 which corresponds to the port specified on the SSH server above. The name <em>proxy.home<\/em> will correspond to how you can refer to it later. By echoing to STDERR (>&#038;2) you can leave yourself notes about each machine to read when you connect.<\/p>\n<pre>\r\n<strong>~\/.ssh\/config<\/strong>\r\n\r\nHost proxy.home\r\n     ProxyCommand ssh user@intermediary 'pkill -x -f \"nc -l 12300\";nc -l 12300'\r\n\r\nHost proxy.laptop\r\n     ProxyCommand ssh user@intermediary 'pkill -x -f \"nc -l 12301\";nc -l 12301'\r\n\r\nHost proxy.laptop2\r\n     ProxyCommand ssh user@intermediary 'echo \"This is laptop2\" >&2;pkill -x -f \"nc -l 12301\";nc -l 12301'\r\n<\/pre>\n<p>If you don&#8217;t want to use the <em>~\/.ssh\/config<\/em> file or cannot you can also specify the proxy on the command line. You need to specify some hostname for the SSH client to save public keys under.<\/p>\n<pre>\r\n$ssh -o \"ProxyCommand ssh user@intermediary 'pkill -x -f \\\"nc -l 12300\\\";nc -l 12300'\" anything\r\n<\/pre>\n<p>Now you can connect to this machine as if you were directly connecting! Note because the cron job only runs every minute there is a lag for the initial connection between 0 and 60 seconds. After this everything should work fast.<\/p>\n<pre>\r\n$ssh user@proxy.home\r\n\r\n$ssh user@proxy.home alpine #read some mail!\r\n\r\n$ssh user@proxy.laptop CoreLocationCLI --once #read location of laptop!\r\n\r\n$ssh user@proxy.laptop say \"I am a laptop\" #mac only\r\n\r\n$ssh-copy-id user@proxy.home #copy your ssh keys for quick login\r\n\r\n$scp importantfiles proxy.home:\/personalfiles # send files home\r\n\r\n$scp proxy.home:\/forgotfiles workfolder # get files from home\r\n\r\n$ssh -D 9050 user@proxy.home #proxy your internet using a SOCKS proxy\r\n<\/pre>\n<p>More info on SSH tunneling can be found here <a href=\"https:\/\/security.web.cern.ch\/security\/recommendations\/en\/ssh_tunneling.shtml\"> Configure SSH for automatic tunneling &#8211; CERN<\/a>, here <a href=\"http:\/\/www.openbsd.org\/cgi-bin\/man.cgi\/OpenBSD-current\/man5\/ssh_config.5\">ssh_config man page &#8211; OpenBSD<\/a>, and here <a href=\"http:\/\/nmap.org\/ncat\/guide\/ncat-tricks.html\">Neat Tricks with ncat &#8211; nmap.org<\/a><\/p>\n<p><center><br \/>\n<script type=\"text\/javascript\">\n    google_ad_client = \"ca-pub-2068283315745938\";\n    google_ad_slot = \"2707197245\";\n    google_ad_width = 400;\n    google_ad_height = 300;\n<\/script><br \/>\n<!-- largerec1 --><br \/>\n<script type=\"text\/javascript\"\nsrc=\"\/\/pagead2.googlesyndication.com\/pagead\/show_ads.js\">\n<\/script><\/center><\/p>\n","protected":false},"excerpt":{"rendered":"<div class=\"mh-excerpt\"><p>Sometimes we want to SSH to machines that are behind restrictive firewalls or just because the IP keeps changing. Here I discuss a way to <a class=\"mh-excerpt-more\" href=\"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/\" title=\"SSH behind firewall using simple ncat proxy and unmodified intermediary server\">[&#8230;]<\/a><\/p>\n<\/div>","protected":false},"author":1,"featured_media":523,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.1 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>SSH behind firewall using simple ncat proxy and unmodified intermediary server - Joseph Paul Cohen PhD<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SSH behind firewall using simple ncat proxy and unmodified intermediary server - Joseph Paul Cohen PhD\" \/>\n<meta property=\"og:description\" content=\"Sometimes we want to SSH to machines that are behind restrictive firewalls or just because the IP keeps changing. Here I discuss a way to [...]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/\" \/>\n<meta property=\"og:site_name\" content=\"Joseph Paul Cohen PhD\" \/>\n<meta property=\"article:published_time\" content=\"2014-11-25T09:12:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2014-11-25T23:57:33+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/josephpcohen.com\/w\/wp-content\/uploads\/2014\/11\/ssh.png\" \/>\n\t<meta property=\"og:image:width\" content=\"500\" \/>\n\t<meta property=\"og:image:height\" content=\"500\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Joseph Paul Cohen\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Joseph Paul Cohen\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/\"},\"author\":{\"name\":\"Joseph Paul Cohen\",\"@id\":\"https:\/\/josephpcohen.com\/w\/#\/schema\/person\/e25d0d5746952220f35d182ca7aa8684\"},\"headline\":\"SSH behind firewall using simple ncat proxy and unmodified intermediary server\",\"datePublished\":\"2014-11-25T09:12:05+00:00\",\"dateModified\":\"2014-11-25T23:57:33+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/\"},\"wordCount\":624,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/josephpcohen.com\/w\/#\/schema\/person\/e25d0d5746952220f35d182ca7aa8684\"},\"articleSection\":[\"References\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/\",\"url\":\"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/\",\"name\":\"SSH behind firewall using simple ncat proxy and unmodified intermediary server - Joseph Paul Cohen PhD\",\"isPartOf\":{\"@id\":\"https:\/\/josephpcohen.com\/w\/#website\"},\"datePublished\":\"2014-11-25T09:12:05+00:00\",\"dateModified\":\"2014-11-25T23:57:33+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/josephpcohen.com\/w\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SSH behind firewall using simple ncat proxy and unmodified intermediary server\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/josephpcohen.com\/w\/#website\",\"url\":\"https:\/\/josephpcohen.com\/w\/\",\"name\":\"Joseph Paul Cohen PhD\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/josephpcohen.com\/w\/#\/schema\/person\/e25d0d5746952220f35d182ca7aa8684\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/josephpcohen.com\/w\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/josephpcohen.com\/w\/#\/schema\/person\/e25d0d5746952220f35d182ca7aa8684\",\"name\":\"Joseph Paul Cohen\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/josephpcohen.com\/w\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/a810b57939e75247f570c9094e7bd16e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/a810b57939e75247f570c9094e7bd16e?s=96&d=mm&r=g\",\"caption\":\"Joseph Paul Cohen\"},\"logo\":{\"@id\":\"https:\/\/josephpcohen.com\/w\/#\/schema\/person\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SSH behind firewall using simple ncat proxy and unmodified intermediary server - Joseph Paul Cohen PhD","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/","og_locale":"en_US","og_type":"article","og_title":"SSH behind firewall using simple ncat proxy and unmodified intermediary server - Joseph Paul Cohen PhD","og_description":"Sometimes we want to SSH to machines that are behind restrictive firewalls or just because the IP keeps changing. Here I discuss a way to [...]","og_url":"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/","og_site_name":"Joseph Paul Cohen PhD","article_published_time":"2014-11-25T09:12:05+00:00","article_modified_time":"2014-11-25T23:57:33+00:00","og_image":[{"width":500,"height":500,"url":"https:\/\/josephpcohen.com\/w\/wp-content\/uploads\/2014\/11\/ssh.png","type":"image\/png"}],"author":"Joseph Paul Cohen","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Joseph Paul Cohen","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/#article","isPartOf":{"@id":"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/"},"author":{"name":"Joseph Paul Cohen","@id":"https:\/\/josephpcohen.com\/w\/#\/schema\/person\/e25d0d5746952220f35d182ca7aa8684"},"headline":"SSH behind firewall using simple ncat proxy and unmodified intermediary server","datePublished":"2014-11-25T09:12:05+00:00","dateModified":"2014-11-25T23:57:33+00:00","mainEntityOfPage":{"@id":"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/"},"wordCount":624,"commentCount":0,"publisher":{"@id":"https:\/\/josephpcohen.com\/w\/#\/schema\/person\/e25d0d5746952220f35d182ca7aa8684"},"articleSection":["References"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/","url":"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/","name":"SSH behind firewall using simple ncat proxy and unmodified intermediary server - Joseph Paul Cohen PhD","isPartOf":{"@id":"https:\/\/josephpcohen.com\/w\/#website"},"datePublished":"2014-11-25T09:12:05+00:00","dateModified":"2014-11-25T23:57:33+00:00","breadcrumb":{"@id":"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/josephpcohen.com\/w\/ssh-behind-firewall-using-simple-ncat-proxy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/josephpcohen.com\/w\/"},{"@type":"ListItem","position":2,"name":"SSH behind firewall using simple ncat proxy and unmodified intermediary server"}]},{"@type":"WebSite","@id":"https:\/\/josephpcohen.com\/w\/#website","url":"https:\/\/josephpcohen.com\/w\/","name":"Joseph Paul Cohen PhD","description":"","publisher":{"@id":"https:\/\/josephpcohen.com\/w\/#\/schema\/person\/e25d0d5746952220f35d182ca7aa8684"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/josephpcohen.com\/w\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/josephpcohen.com\/w\/#\/schema\/person\/e25d0d5746952220f35d182ca7aa8684","name":"Joseph Paul Cohen","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/josephpcohen.com\/w\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/a810b57939e75247f570c9094e7bd16e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/a810b57939e75247f570c9094e7bd16e?s=96&d=mm&r=g","caption":"Joseph Paul Cohen"},"logo":{"@id":"https:\/\/josephpcohen.com\/w\/#\/schema\/person\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/josephpcohen.com\/w\/wp-json\/wp\/v2\/posts\/515"}],"collection":[{"href":"https:\/\/josephpcohen.com\/w\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/josephpcohen.com\/w\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/josephpcohen.com\/w\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/josephpcohen.com\/w\/wp-json\/wp\/v2\/comments?post=515"}],"version-history":[{"count":52,"href":"https:\/\/josephpcohen.com\/w\/wp-json\/wp\/v2\/posts\/515\/revisions"}],"predecessor-version":[{"id":583,"href":"https:\/\/josephpcohen.com\/w\/wp-json\/wp\/v2\/posts\/515\/revisions\/583"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/josephpcohen.com\/w\/wp-json\/wp\/v2\/media\/523"}],"wp:attachment":[{"href":"https:\/\/josephpcohen.com\/w\/wp-json\/wp\/v2\/media?parent=515"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/josephpcohen.com\/w\/wp-json\/wp\/v2\/categories?post=515"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/josephpcohen.com\/w\/wp-json\/wp\/v2\/tags?post=515"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}