Tag Info

Hot answers tagged

70

I love explaining this kind of thing through visualization. :-) Think of your SSH connections as tubes. Big tubes. Normally, you'll reach through these tubes to run a shell on a remote computer. The shell runs in a virtual terminal (tty). But you know this part already. Think of your tunnel as a tube within a tube. You still have the big SSH ...


40

Administratively prohibited generally means you've been blocked by a firewall or equivalent control software. This will be somewhere between localhost and remote. When you connect to the local endpoint on localhost, the other end of the ssh tunnel (also on localhost) will try to establish a connection to remote:8983. This is what is being blocked. You ...


22

I have drawn some sketches The machine, where the ssh tunnel command is typed is called »your host«. Introduction local: -L Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side. ssh -L sourcePort:forwardToHost:onPort connectToHost means: connect with ssh to connectToHost, and ...


20

channel 1: open failed: administratively prohibited: open failed The above message refers to your SSH server rejecting your SSH client's request to open a side channel. This typically comes from -D, -L or -w, as separate channels in the SSH stream are required to ferry the forwarded data across. Since you are using -L (also applicable to -D), there are two ...


16

I'll start with the raw facts : You have: A - your FreeBSD box, B - your router and C - some machine with Internet access. This is how it looks like: .-----. .-----. .-----. | A | == | B | - - ( Internet ) - - | C | '-----' '-----' '-----' \_________ ________/ v `- this ...


15

Thats a lot more complicated than it needs to be :-) Start the tunnel: ssh -f -N -D 9999 -M -S /tmp/ssh_tunnel_%h.sock -o ExitOnForwardFailure=yes $SSH_HOST && \ echo "ssh tunnel started successfully" || \ echo "ssh tunnel failed to start" Stop the tunnel: ssh -S /tmp/ssh_tunnel_%h.sock -O exit $SSH_HOST . Thats all you need to do. If you ...


14

The simple answer is yes, but please note that the tunnel is actually started on your computer. The way it works is that you create an SSH connection to the server (which is secure) and then instruct the SSH to listen to a port on your side and forward whatever connections come in - to a specific port on a specific host address on the server side. The target ...


10

From the SSH Protocol documentation, regarding channels: All terminal sessions, forwarded connections, etc., are channels. Either side may open a channel. Multiple channels are multiplexed into a single connection. Channels are identified by numbers at each end. The number referring to a channel may be different on each side. Requests to ...


9

Something like: dd if=/dev/video0 | mplayer tv://device=/dev/stdin works for me (SOA#1) locally. So does: ssh localhost dd if=/dev/video0 | mplayer tv://device=/dev/stdin As well as mkfifo test dd if=/dev/video0 of=test & mplayer tv://device=test Hence: Try without named pipe Check bandwidth Also - how does in not work (display black screen, ...


9

It sounds to me like you need a socks client, or a ssh client that understand socks. -D is for ssh to be a socks server/proxy. You could use ssh under tsocks, or another SOCKS wrapper. Or use ssh's ProxyCommand in conjunction with socat or nc -X: ssh -o ProxyCommand='socat - socks:B:%h:21,socksport=1080' C To have a HTTP proxy that uses the SOCKS server ...


8

"administratively prohibited" is a specific ICMP message flag that boils down to "The administrator explicitly wants this connection blocked". Check your iptables settings.


8

Have a look at How do I connect to a pc through another pc using ssh You create a new ~/.ssh/config entry with the name tunnelb: Host tunnelb HostName hostB User user ProxyCommand ssh user@hostA nc %h %p If you have a recent version of ssh you can use Proxycommand ssh user@hostA -W %h:%p instead. This is preferred as it does not rely on nc Now you can ...


8

ssh tunneling works by using the already established ssh connection for sending additional traffic. When you connect to a remote server, you usually just have 1 channel for the normal user interaction (or 3 channels if you consider STDIN/STDOUT/STDERR separate). At any time, the local or remote ssh process can open additional channels on the existing ...


8

No, ssh doesn't support regular expression in ssh_config (1) and the example you gave aren't regular expressions. ssh_config (1) supports PATTERNS, i.e. you can define a pattern for your IPs, i.e: Host 192.168.1.* ProxyCommand ssh production-server nc %h %p and you should be able to have forwarding for all your internal IPs. Another solution would be to ...


7

If the simulation software really checks that the display number is 0, you can arrange for your remote display to be 0. Make sure you're not running Xsun locally or run it on a different display (e.g. Xsun :1). In the OpenSSH server configuration file /etc/ssh/sshd_config, add the line X11DisplayOffset 0. If you connect over ssh, the DISPLAY environment ...


7

Meanwhile I found autossh which looks like exactly what I need.


7

The performance problem arise when you are tunneling TCP over TCP because you have two layers doing adaptive corrections (slow start, congestion avoidance, fast restransmit see RFC2001). Not bieng aware of one another they will experience great difficulties if you have loss on the outer connection. This page describes the phenomenon in detail. edit: ...


7

You have your definition of "forward" mixed up. It is the packets that are forwarded (from local to remote for -L, and from remote to local for -R).


7

I have drawn some sketches The machine, where the ssh tunnel command is typed (or in your case: Putty with tunneling is started) is called »your host«. Introduction local: -L Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side. ssh -L sourcePort:forwardToHost:onPort ...


7

As said in other posts, if you don't want a prompt on the remote host, you must use the -N option of SSH. But this just keeps SSH running without having a prompt, and the shell busy. You just need to put the SSH'ing as a background task with the & sign : ssh -N -L 8080:ww.xx.yy.zz:80 user@server & This will launch the ssh tunnelling in the ...


7

strace -e trace=connect -f yourprogram or using a dump file strace -o yourprogram.strace -e trace=connect -f yourprogram


6

At least one answer is that the machine "remote" is unreachable with ssh for some reason. The error message is just absurd.


6

A secure default for an OpenSSH installation will have GatewayPorts set to no. This is precisely that restriction. edit See the PermitOpen directive: Specifies the destinations to which TCP port forwarding is permitted. The forwarding specification must be one of the following forms: PermitOpen host:port PermitOpen ...


6

The PermitOpen accepts any when its the only argument. Meaning it accepts PermitOpen any. The only way I can think of to do this would be to use an iptables rule. iptables -I OUTPUT -p tcp ! --dport 80 -m owner --uid-owner 1000 -j REJECT This would reject any outbound traffic from user with UID=1000 that isnt going to port 80


6

You don't need to tunnel ssh. You can ssh to the intermediary host then ssh to anywhere else you need. You can even do it in a single command by forcing allocation of a pseudo-tty using the -t flag: me@inside$ ssh -t intermediary ssh external Last login: Fri Sep 21 14:13:25 2012 from intermediary me@external$ logout Connection to external closed. ...


6

That's a tricky thing to get done. Your best bet is to use some SOCKS redirector like socksify or redsocks, but none will give you what a VPN can, so you'd better set it up. VPN allows you to connect even whole networks, forward your traffic through secure channels, make your computers all appear as in one LAN and so on. You can use OpenVPN to do that - ...


5

Your solution would work, but I think it's a little bit rougher than it needs to be. In particular, the vnc over ssh on android is going to be troublesome. It's possible, but it's not as usable or stable as it could be. I would suggest using RDP instead. There are great RDP clients on Android, the bandwidth consumption is a lot lower so it's more usable and ...


5

I add to the .ssh/config such definition: Host SERVER-A ProxyCommand ssh SERVER-B nc -q0 %h %p 2> /dev/null and then just use ssh or scp in normal way: ssh user@SERVER-A or scp file.tar.gz user@SERVER-A:~ During setting the connection with SERVER-A the ssh library finds these configuration. It tells that ssh should use some proxy command to ...


5

The VideoLAN Project exists in large part to do just what you desire. I've not used its streaming capabilities but in its single machine use it has shown to be rock solid for me.


5

Short answer: yes, ssh can do this. The answer's in your question: "reverse" tunneling. See the -R option to the ssh client: -R [bind_address:]port:host:hostport Specifies that the given port on the remote (server) host is to be forwarded to the given host and port on the local side. This works by allocating a socket to ...



Only top voted, non community-wiki answers of a minimum length are eligible