1

I have a local server that only allows connections within the internal network. I have another server inside the internal network that can connect to outside the network. I want to use the second server as a tunnel for the first, so I can get outside connections with the first.

I can ssh to the second server just fine. However, when I run:

sudo sshuttle -r myuser@myserver 0/0 -vv

and then type in my local password, and then my remote password, it just hangs indefinitely, and no connections on the server can get out. Again, I can do ssh myuser@myserver just fine.

Any suggestions for debugging this? I'm on CentOS 7.

  • Is your myuser able to create tun devices (e.g. root?). – Jakuje Dec 16 '16 at 20:10
  • @Jakuje What would be the quickest way to test that? – user1566200 Dec 16 '16 at 20:12
  • If the myuser is not root, it probably does not have these permissions. You can try it with pure ssh using ssh -vvv -w 0:0 myuser@myserver, which should yell some errors. – Jakuje Dec 16 '16 at 20:15
  • You were right - sshuttle works when I ssh in as root. – user1566200 Dec 16 '16 at 20:22
1

To make sshuttle working, you need a superuser privileges on both client and server (to create tun devices on both ends). This is not possible with normal (myuser) users.

This should work with root user, if he is allowed to log in. This is generally not a good idea to allow root logins, so restricting this user to public key authentication (PasswordAuthentication no) or prevent running commands (ForceCommand /usr/sbin/nologin) s also good idea, but securing the server is obviously not the part of this question.

  • Is it still a bad idea to have root access to a server via SSH, if SSH connections are only allowed when they are coming from the internal network? – user1566200 Dec 16 '16 at 20:33
  • If you have a filter only for internal network, it is quite fine, if the network is trusted. – Jakuje Dec 16 '16 at 20:34
  • just read the question. Makes sense. – Jakuje Dec 16 '16 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.