Securely tunnel port through intermediate host

Question

I'm looking to route a port for VNC back to my house here. I have to jump over a single host to then hop to my actual work machine.

• sittinghere will be my local home machine
• hopper will by the intermediate hop I need to make
• overthere will be the remote work machine

I can do this to SSH into my work machine:

ssh -t hopper "ssh -t overthere"

I'd like to use port forwarding to forward remote port 5900 on overthere to local port 5900 on sittinghere. However, I'd prefer to be able to do it without binding to a port openly on hopper as anyone on that machine would be able to attach to my VNC connection.

Is there any way for me to forward that port to my local machine securely with no one being able to get access to it on hopper?

Answer 1

I ended up using some SSH ~/.ssh/config hacks to make this happen:

Host hopper
    User naftuli
    ForwardAgent yes

Host overthere
    User naftuli
    ForwardAgent yes
    ProxyCommand ssh -q hopper nc overthere 22

What this does is that when I attempt to connect to ssh overthere from sittinghere, it connects to hopper and then proxies the SSH connection to port 22 on overthere (ie: SSH on overthere).

This has some awesome side-effects:

ssh -L 5900:localhost:5900 overthere "x11vnc -display :0 -localhost"

Everything works awesome and as far as I can tell, 5900 isn't opened on hopper, only forwarded directly from overthere to sittinghere.

Answer 2

Using SSH's native ability to forward ports. From sittinghere execute:

 ssh -v -N -L 5900:overthere:5900 user@hopper

Point your VNC client to localhost:5900 and the traffic will be tunneled to overthere:5900 through the SSH connection established on hopper

Answer 3

You can forward a port from sittinghere to overthere's SSH port through hopper. Then you can use that port to reach overthere directly from sittinghere. In this second SSH session you can forward VNC or whatever other ports you like while hopper sees only an encrypted SSH session.

First SSH session:

ssh -f -N -L 7022:overthere:22 hopper

Now tell the SSH client how it can reach overthere by adding this config to ~/.ssh/config on sittinghere

Host overthere
    HostName hopper
    Port 7022
    HostKeyAlias overthere

Second SSH session:

ssh -f -N -L 5900:localhost:5900 overthere

Or just a regular interactive SSH session without the VNC port tunnel:

ssh overthere

If you don't want to bother adding lines to ~/.ssh/config you can still tell it how to connect to overthere from the command line:

ssh -p 7022 hopper

...but without the HostKeyAlias SSH will not verify overthere's key fingerprint correctly.

All command lines are to be run from sittinghere.

Incidentally, I think you probably don't need to be using ssh's -t option.

Answer 4

If you're using the VNC client vncviewer from the command line you can use the -via switch to tell it to tunnel through a user@host prior to connecting to some other host's VNC server.

Example

$ vncviewer -via user@host localhost:0

You can also use vinagre to connect via a SSH tunnel like so through the GUI. To do so set your connection up similar to this via the connection dialog in vinagre:

              

Which will result in your connection coming up, tunneled through the SSH tunnel host.

    

References

• Use VNC? Encrypt It Via SSH

Answer 5

First connect hopper while making tunnel between worker and home pc.

ssh -f ismail@hopper -L 2222:overthere:22 -N

then make ssh ro overthere with vnc tunnel

ssh -p 2222 -f ismail@localhost -L 5900:localhost:5900

Now you can connect with vnc. By the way change configuration of vnc to listen localhost