0

Here's the thing:

  • a mongodb client on the client machine
  • a SSH terminal on a jump machine
  • the mongodb server on the target machine

I would like the client to connect to the server through the jump machine, using SSH, but I CANNOT use regular tunneling

Here's what I've done:

  • on the client:
socat TCP4-LISTEN:3340,fork,reuseaddr STDIO | ssh jump -W target:6003

  • on the target:
socat TCP4-LISTEN:6003 TCP4:127.0.0.1:27017
mongo server is of course listening on 27017

Now on the client, I type this:

$ mongo 127.0.0.1:3340/admin
MongoDB shell version v3.6.8
connecting to: mongodb://127.0.0.1:3340/admin
show dbs
2021-03-02T03:02:39.162+0100 E QUERY    [thread1] Error: network error while attempting to run command 'isMaster' on host '127.0.0.1:3340'  :
connect@src/mongo/shell/mongo.js:257:13
@(connect):1:6
exception: connect failed

Here's what I see in the SSH session:

Authenticated to jump ([<jump_IP>]:22).
debug1: channel_connect_stdio_fwd <target_IP>:6003
debug1: channel 0: new [stdio-forward]
debug1: getpeername failed: Bad file descriptor
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
?AHsmastertopologyVersion-processId`"�蚇���countermaxBsonObjectSizemaxMessageSizeBytesl�maxWriteBatchSize��       localTime\[��wlogicalSessionTimeoutMinutesconnectionIdmminWireVersionmaxWireVersion       readOnlyok�?^Cdebug1: channel 0: free: direct-tcpip: listening port 0 for <target_IP> port 6003, connect from 127.0.0.1 port 65535 to UNKNOWN port 65536, nchannels 1
debug1: fd 0 clearing O_NONBLOCK


show dbs
�@H�okerrmsgDThe client metadata document may only be sent in the first isMastercode�codeNameClientMetadataCannotBeMutated


Killed by signal 2.

So I can somehow see some "text" being transfered, but obviously not working

It's not the simplest architecture. Any help is appreciated

PS: the reason I can't use the -L tunnel option, which would work perfectly, is that:

  • the SSH terminal arrives in a container
  • the SSH tunnel would arrive on the host machine

The reason? When I SSH with a certain user, the shell used is actually the inside of the docker container. This allows me to "lock" some users inside containers, without having to create SSH/passwd inside the containers. Also, only a certain container IP address is allowed for a certain mongo account, so the client mongo has to go through the container terminal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.