3

So far I have had a home server where I use this technique to access it outside home.

But now I have other requirement, I want to make this from a docker container inside my home server. But if I try to connect to the tunnel I get a connection refused error.

So, in order to setup something like this, I have a VPS online, and my home server. Inside my home server I have a container running. I exchange the public keys between the VPS and the container, by properly configuring the authorized_keys file in each other. I have confirmed that I am running the container with -p 22:22, and that no SSH service is running outside the container that could be using the host's port 22.

Then I run this command in the container:

$ ssh -vvvfN -oStrictHostKeyChecking=no -R 20007:localhost:22 myvps@myvpsdomain.com

Then in my VPS I type this and the output is followed

$ ssh -vvv container_user@localhost -p 20007
OpenSSH_7.2p2 Ubuntu-4ubuntu2.1, OpenSSL 1.0.2g  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "localhost" port 20009
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to localhost [127.0.0.1] port 20009.
debug1: Connection established.
debug1: identity file /home/raspi/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/raspi/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/raspi/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/raspi/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/raspi/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/raspi/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/raspi/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/raspi/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.1
ssh_exchange_identification: Connection closed by remote host

Now, when I check the container logs, this is what I see:

debug1: client_input_global_request: rtype hostkeys-00@openssh.com 
want_reply 0
debug1: remote forward success for: listen 20007, connect localhost:22
debug1: All remote forwarding requests processed
debug1: client_input_channel_open: ctype forwarded-tcpip rchan 2 win 2097152 max 32768
debug1: client_request_forwarded_tcpip: listen localhost port 20007, originator 127.0.0.1 port 60364
debug2: fd 7 setting O_NONBLOCK
debug2: fd 7 setting TCP_NODELAY
debug1: connect_next: host localhost ([::1]:22) in progress, fd=7
debug3: fd 7 is O_NONBLOCK
debug3: fd 7 is O_NONBLOCK
debug1: channel 0: new [127.0.0.1]
debug1: confirm forwarded-tcpip
debug3: channel 0: waiting for connection
debug1: channel 0: connection failed: Connection refused
debug2: fd 8 setting O_NONBLOCK
debug2: fd 8 setting TCP_NODELAY
debug1: connect_next: host localhost ([127.0.0.1]:22) in progress, fd=8
debug3: channel 0: waiting for connection
debug1: channel 0: connection failed: Connection refused
connect_to localhost port 22: failed.
debug2: channel 0: zombie
debug2: channel 0: garbage collecting
debug1: channel 0: free: 127.0.0.1, nchannels 1
debug3: channel 0: status: The following connections are open:

Remember that all these steps work perfectly when run outside a container, but somehow, inside the container the VPS cannot make the connection using the tunnel...

EDIT: Here is the code of the container making the tunnel to the remote server:

FROM ubuntu:16.04

RUN apt-get update && apt-get install -y ssh htop nano autossh
RUN ssh-keygen -f $HOME/.ssh/id_rsa -t rsa -N '';                                             \
COPY authorized_keys $HOME/.ssh/
echo '=======SAVE THIS KEY TO ~/.ssh/authorized_keys in the Cloud Server=======';             \
cat $HOME/.ssh/id_rsa.pub;                                                                    \
echo '=========================================================================';

RUN sleep 20 # Give me time to put the key in the cloud server

RUN echo "/usr/bin/ssh -vvvfN -oStrictHostKeyChecking=no -R 20009:localhost:22 myvps@myvpsdomain.com" > $HOME/connect.sh; \
chmod 777 $HOME/connect.sh

EXPOSE 22
EXPOSE 20009
CMD ["sh", "-c", "$HOME/connect.sh"]

This Dockerfile:

  • generates a key pair,
  • stores the pub key of the remote server,
  • waits 20 secs for me to put that key pair in the remote server authorized_keys,
  • and then opens the tunnel.

It doesn't work well as you can see for the error messages. But if I do these exact same steps in a physical machine instead of a container it just works fine...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.