Re: Tunneling

Hi

Thanks for all the responses we have put together a little more
information for what we are trying to do.

Wrapping a pserver/cvs connection in a ssh tunnel is great idea and has
been considered by us to improve the insecure pserver connection, but it
doesn't help our dilema.  We need to enable clients, who are behind
strict firewalls, to access remote cvs repositories.

Many companies/sites do not allow outgoing ssh connections via tcp/22.
In fact we are assuming the only open outgoing port to the client is
tcp/80/443 for web traffic.  Most firewalls only permit http traffic out
through tcp/80/443, so setting up a ssh tunnel or having pserver listen on
tcp/80/443 won't work.

Kazaa, et. al. do a great job of encapsulating their traffic as web
traffic through tcp/80 and that's the type of solution we're chasing
after.

Again thanks for all your responses we appreciate the help

Jim


> Daniel Mladek wrote:
>>
>> Hi,
>>
>> I can add to what Milos said that for creating tunnel we are using
>> something similar to this:
>>
>> xterm -e ssh -v -x -C -L 2401:localhost:2401 userOnPserver@cvspserver &
>>
>> Now the port 2401 (CVS pserver) on your own machine will forward
>> connections to the remote CVS server. Note that you can also pass -g to
>> ssh and you can then use this tunnel from a different machine than the
>> one you ran ssh on.
>
> Yes, this is probably how our "cvstunnel" box works. We connect to
> :pserver:<username>@cvstunnel:/cvs which is then forwarded this way to
> cvs.netbeans.org. This is a pleasant way how to get through the proxy.
>
>>
>> How to set up environment/user on cvspserver I don't know.
>> Just that's a client part.
>
> IMHO it should be enough when the server runs sshd.
>
> -Martin
>
>>
>> Hope that'll help little bit too:)
>> -dan
>>
>>  Milos Kleint wrote:
>>
>> > martin, I think we've done something similar when we were (well, you
>> > still are) connecting to netbeans.org from sun network.
>> > we used a java ssh tunneling application which was listening on the
>> > local machine on the cvs port (4201), our cvs connected to local
>> > machine using the pserver access method, but it was tunneled by the
>> > ssh app through the http proxies or something (i'm on shaky ground
>> > here, not intranet/firewall expert) and connected to the cvs port on
>> > the netbeans.org server.
>> > Is that what you intend to do, Jim?
>> >
>> > in this scenario, on the client side the cvs library was used as is,
>> > only with different cvs root. (eg. :pserver:mkleint@localhost:/cvs
>> > instead of :pserver:[email protected]:/cvs)
>> > the hard part prolly setting up the server to allow tunneling, set up
>> > the proxies and all the rest of the firewall bussiness I have no clue
>> > about.. :)
>> >
>> > Milos
>> >
>> > Jim Hannula wrote:
>> >
>> >> Martin,
>> >>
>> >> Thanks for the quick response.  We are trying to create a solution
>> >> where a
>> >> client is behind a firewall where connections out to tcp/2401
>> (pserver)
>> >> are not allowed.
>> >>
>> >> What we are trying to do is to tunnel/encapsulate normal cvs traffic
>> >> through port tcp/80 (or 443) as http traffic.  The remote cvs server
>> >> would
>> >> be running a servlet which listens on tcp/80 (or 443) and then
>> >> connect the
>> >> client to the normal pserver on that host.  We would like the serlvet
>> to
>> >> connect to the pserver since we do not want to handle client
>> >> authentication.
>> >>
>> >> Have you come across this scenario before?  We are especially looking
>> >> into
>> >> how to properly handle this on the client.  Ie, a client making
>> >> normal cvs
>> >> requests and having those changed into http traffic and passed out
>> via
>> >> tcp80/443.
>> >>
>> >> Thanks
>> >>
>> >> Jim
>> >>
>> >>
>> >>
>> >>
>> >>
>> >>
>> >>> Jim Hannula wrote:
>> >>>
>> >>>
>> >>>> rami
>> >>>>
>> >>>> Thanks for your response.  We are trying to implement HTTP
>> tunneling.
>> >>>>
>> >>>>
>> >>>
>> >>> Well, I do not much understand what are you trying to do. CVS uses
>> it's
>> >>> own
>> >>> communication protocol, not HTTP. Please elaborate more on what do
>> you
>> >>> need to
>> >>> do.
>> >>>
>> >>> In case you're behind a firewall and need to get through a proxy,
>> >>> please
>> >>> read
>> >>> http://javacvs.netbeans.org/doc/HowToSocksProxy.html
>> >>>
>> >>>
>> >>>
>> >>>>> Are you referring here to ssh connection (:ext:)?
>> >>>>> If yes, then it is coming but give it a few weeks time.
>> >>>>>
>> >>>>
>> >>> This is in progress, but the estimate is that it will take several
>> >>> weeks
>> >>> :-((
>> >>>
>> >>> -Martin
>> >>>
>> >>>
>> >>>
>> >>>>> - rami
>> >>>>>
>> >>>>>
>> >>>>>
>> >>>>>> -----Original Message-----
>> >>>>>> From: Jim Hannula [mailto:[email protected]]
>> >>>>>> Sent: Tuesday, September 23, 2003 1:48 AM
>> >>>>>> To: [email protected]
>> >>>>>> Subject: [javacvs-dev] Tunneling
>> >>>>>>
>> >>>>>>
>> >>>>>> Hello
>> >>>>>>
>> >>>>>> We have a team of developers working on a project that is using
>> >>>>>>
>> >>>>>
>> >>>> javacvs
>> >>>>
>> >>>>
>> >>>>>> for out interaction with cvs.  We have downloaded the latest
>> >>>>>>
>> >>>>>
>> >>>> cvslib.jar
>> >>>>
>> >>>>
>> >>>>>> from the web site.
>> >>>>>
>> >>>>>
>> >>>>>
>> >>>>>> We are in need of a tunneling connection to cvs.  Has anyone
>> written
>> >>>>>>
>> >>>>>
>> >>>> or
>> >>>>
>> >>>>
>> >>>>>> can point us in the right direction for help with a tunneling
>> >>>>>> connection
>> >>>>>> class for the javacvs client?
>> >>>>>>
>> >>>>>> Thanks
>> >>>>>>
>> >>>>>> Jim
>> >>>>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: [email protected]
>> For additional commands, e-mail: [email protected]
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>
>