1

I have a local server that only allows connections within the internal network. I have another server inside the internal network that can connect to outside the network. I want to use the second server as a tunnel for the first, so I can get outside connections with the first.

I can ssh to the second server just fine. However, when I run:

sudo sshuttle -r myuser@myserver 0/0 -vv

and then type in my local password, and then my remote password, it just hangs indefinitely, and no connections on the server can get out. Again, I can do ssh myuser@myserver just fine.

Any suggestions for debugging this? I'm on CentOS 7.

4
  • Is your myuser able to create tun devices (e.g. root?).
    – Jakuje
    Dec 16, 2016 at 20:10
  • @Jakuje What would be the quickest way to test that? Dec 16, 2016 at 20:12
  • If the myuser is not root, it probably does not have these permissions. You can try it with pure ssh using ssh -vvv -w 0:0 myuser@myserver, which should yell some errors.
    – Jakuje
    Dec 16, 2016 at 20:15
  • You were right - sshuttle works when I ssh in as root. Dec 16, 2016 at 20:22

1 Answer 1

1

To make sshuttle working, you need a superuser privileges on both client and server (to create tun devices on both ends). This is not possible with normal (myuser) users.

This should work with root user, if he is allowed to log in. This is generally not a good idea to allow root logins, so restricting this user to public key authentication (PasswordAuthentication no) or prevent running commands (ForceCommand /usr/sbin/nologin) s also good idea, but securing the server is obviously not the part of this question.

3
  • Is it still a bad idea to have root access to a server via SSH, if SSH connections are only allowed when they are coming from the internal network? Dec 16, 2016 at 20:33
  • If you have a filter only for internal network, it is quite fine, if the network is trusted.
    – Jakuje
    Dec 16, 2016 at 20:34
  • just read the question. Makes sense.
    – Jakuje
    Dec 16, 2016 at 20:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .