So far I have had a home server where I use this technique to access it outside home.
But now I have other requirement, I want to make this from a docker container inside my home server. But if I try to connect to the tunnel I get a connection refused error.
So, in order to setup something like this, I have a VPS online, and my home server. Inside my home server I have a container running. I exchange the public keys between the VPS and the container, by properly configuring the
authorized_keys file in each other. I have confirmed that I am running the container with
-p 22:22, and that no SSH service is running outside the container that could be using the host's port 22.
Then I run this command in the container:
$ ssh -vvvfN -oStrictHostKeyChecking=no -R 20007:localhost:22 email@example.com
Then in my VPS I type this and the output is followed
$ ssh -vvv container_user@localhost -p 20007 OpenSSH_7.2p2 Ubuntu-4ubuntu2.1, OpenSSL 1.0.2g 1 Mar 2016 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: Applying options for * debug2: resolving "localhost" port 20009 debug2: ssh_connect_direct: needpriv 0 debug1: Connecting to localhost [127.0.0.1] port 20009. debug1: Connection established. debug1: identity file /home/raspi/.ssh/id_rsa type 1 debug1: key_load_public: No such file or directory debug1: identity file /home/raspi/.ssh/id_rsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/raspi/.ssh/id_dsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/raspi/.ssh/id_dsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/raspi/.ssh/id_ecdsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/raspi/.ssh/id_ecdsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/raspi/.ssh/id_ed25519 type -1 debug1: key_load_public: No such file or directory debug1: identity file /home/raspi/.ssh/id_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.1 ssh_exchange_identification: Connection closed by remote host
Now, when I check the container logs, this is what I see:
debug1: client_input_global_request: rtype firstname.lastname@example.org want_reply 0 debug1: remote forward success for: listen 20007, connect localhost:22 debug1: All remote forwarding requests processed debug1: client_input_channel_open: ctype forwarded-tcpip rchan 2 win 2097152 max 32768 debug1: client_request_forwarded_tcpip: listen localhost port 20007, originator 127.0.0.1 port 60364 debug2: fd 7 setting O_NONBLOCK debug2: fd 7 setting TCP_NODELAY debug1: connect_next: host localhost ([::1]:22) in progress, fd=7 debug3: fd 7 is O_NONBLOCK debug3: fd 7 is O_NONBLOCK debug1: channel 0: new [127.0.0.1] debug1: confirm forwarded-tcpip debug3: channel 0: waiting for connection debug1: channel 0: connection failed: Connection refused debug2: fd 8 setting O_NONBLOCK debug2: fd 8 setting TCP_NODELAY debug1: connect_next: host localhost ([127.0.0.1]:22) in progress, fd=8 debug3: channel 0: waiting for connection debug1: channel 0: connection failed: Connection refused connect_to localhost port 22: failed. debug2: channel 0: zombie debug2: channel 0: garbage collecting debug1: channel 0: free: 127.0.0.1, nchannels 1 debug3: channel 0: status: The following connections are open:
Remember that all these steps work perfectly when run outside a container, but somehow, inside the container the VPS cannot make the connection using the tunnel...
EDIT: Here is the code of the container making the tunnel to the remote server:
FROM ubuntu:16.04 RUN apt-get update && apt-get install -y ssh htop nano autossh RUN ssh-keygen -f $HOME/.ssh/id_rsa -t rsa -N ''; \ COPY authorized_keys $HOME/.ssh/ echo '=======SAVE THIS KEY TO ~/.ssh/authorized_keys in the Cloud Server======='; \ cat $HOME/.ssh/id_rsa.pub; \ echo '========================================================================='; RUN sleep 20 # Give me time to put the key in the cloud server RUN echo "/usr/bin/ssh -vvvfN -oStrictHostKeyChecking=no -R 20009:localhost:22 email@example.com" > $HOME/connect.sh; \ chmod 777 $HOME/connect.sh EXPOSE 22 EXPOSE 20009 CMD ["sh", "-c", "$HOME/connect.sh"]
- generates a key pair,
- stores the pub key of the remote server,
- waits 20 secs for me to put that key pair in the remote server authorized_keys,
- and then opens the tunnel.
It doesn't work well as you can see for the error messages. But if I do these exact same steps in a physical machine instead of a container it just works fine...