Re: Reverse SSH tunelling

I've done a lot ssh-tunneling (back an forth,
cascaded-ssh-portforwarding ...) myself, because I think that allowing
the the needed ports is better than to allow all ports, then restrict it
to the ports needed. SSH-Tunnels ar also very easy to implement and
straight-forward. You can "just do it", needing only an ssh-client at hand.
I aggree with Glynn in considering a "real" VPN for persistent server-to
server-tunnels, although the reverse ssh-tunnelling has it's charm.
Not everything is so easily done with this technique (broadcasting, udp,
...). Furthermore to implement a persistent server-to-server tunnel,
implies some locking mechanism, that you have to maintain yourself, so I
decided to look into VPNning myself and luckily found openvpn!
I think openvpn is a good choice because of it's easy setup. Also it
should be reasonably secure, since it relys on the security of ssl.
It runs in userspace and utilizes one udp-port per connection.
If you want to give this a try:
	http://openvpn.sourceforge.net/

nice tunneling, martin.


Glynn Clements schrieb:
> Raistlin Majere wrote:
> 
> 
>>	I need some advice .. I have a situation where about fifty servers will
>>be located in fifty sites that cannot allow services to be hosted. These
>>servers will be in private network space behind firewalls. I can use
>>them to 'scp' files out to a common home base server, but sometimes I
>>need to access a command line console on these servers. I am thinking of
>>having a hourly cron job ssh out to my home base server and leaving that
>>tunnel open  so that I can access that console, but am looking for the
>>specific way of doing this. Security os pf the utmost concern, so I need
>>some sort of encrypted tunnel, hence the thought of ssh, but I don't
>>know how to do this 'reverse' tunnel... I was also thinking of a 'free
>>swan' vpn tunnel .. 
> 
> 
> If you have root on the remote systems, I would suggest using a real
> VPN rather than the sort of ad-hoc mechanisms which others have
> suggested. The choice of exactly which VPN is likely to be determined
> by what you can get through the firewall; e.g. if it only allows TCP,
> then you will be limited to a PPP/SLIP-over-SSH/SSL type VPN.
>