One port too far

[entropy1024]

Hello all.

I have been watching the LAN Turtle 104 - Persistent Shell Access with AutoSSH video at https://www.youtube.com/watch?v=uIdvvrDrRj0 and at 5:15 it shows three fields for the setup, they are User@host, Remote Port & Local port.

On my Turtle, which is probably a newer version of firmware than the one in the video, there is a fourth field simply named Port.

As I understand it the Turtles local port is 22. It connects to the host via port 2222. Therefore on the host if you SSH to port 2222 it connects to the Turtle on it's port 22 through the 2222 tunnel. So you need a local port (22) and remote port (2222) to make this work, as shown in the demo video above.

What is this extra field named 'Port' that I have, and what should it be set too? I entered 22 for this port and it all works. Just not clear what it's purpose is.

Many thanks for any help.

Tim

[Just_a_User]

58 minutes ago, entropy1024 said:

Just not clear what it's purpose is.

Hi Tim, we briefly spoke on IRC. I continued to look into it afterwards to try and get some clarity myself.

I'm pretty sure it allows you to use a non standard port to connect to on the  server. I don't think this was possible before on the older version of autossh module config interface.

I looked in the modules GitHub       repo there isnt many extra clues.

So if that is the case, we have user@host and port -  then that leaves the two other options remote and local.  I found a nice definition of both that seems to indicate this is an either or situation. Or maybe both?

When it comes to the art of SSH tunnelling, there are basically two options where 
to relay a port to.

You can relay a port from a remote server to your local machine with `ssh -L`, 
hence called local port forwarding. A very basic use-case is if your remote server
has a MySQL database daemon listening on port `3306` and you want to access this 
daemon from your local computer.

The second option is to make your local port available on a remote server (`ssh -R`).
Remote port forwarding might come in handy if you for example want to make your local 
web-server available on a port of a public server, so that someone can quickly check 
what your local web-server provides without having to deploy it somewhere publicly.

I may be wrong, so would also like some confirmation. But this is how i see it at the moment. When I get some uninterrupted time I will try to set it up and have a play for a few hours, its been too long.

 

[entropy1024]

Thanks again for the support. 

When you say the server is that the Turtle? 

The way I use the Turtle is to spin up a droplet on DigitalOcean and get the turtle to autoSSH into that 'host' machine, does that make the turtle the server?

Cheers

Tim

[Just_a_User]

15 minutes ago, entropy1024 said:

When you say the server is that the Turtle? 

No I would say the server is the VPS, The turtle is effectively a client of the server and so would your laptop.

So i think the PORT option allows you to run your VPS ssh server on a non standard port. Avoiding obvious SSH traffic out of the targets network and also limiting exposure against your VPS  from whoever is looking for ssh ports to probe

[entropy1024]

Are you saying that when the turtle refers to the host that's actually the server? 

So you think that if I set the PORT option to 21 for example then the turtle would connect back to the VPS using that port, in this case looking like an FTP connection. Does that sound about right?

Cheers

Tim

[Just_a_User]

42 minutes ago, entropy1024 said:

So you think that if I set the PORT option to 21 for example then the turtle would connect back to the VPS using that port, in this case looking like an FTP connection. Does that sound about right?

Again im not the best person to ask but that's how I see it yes, unless they actually look at the traffic itself then they would see the difference. but it could also allow you through open ports if 21 -22 outbound are blocked out, say 443 or 80 if not in use on the VPS.

42 minutes ago, entropy1024 said:

Are you saying that when the turtle refers to the host that's actually the server? 

I would think user@host would be the VPS. you would set up a user with limited access to the rest of the VPS in case its compromised.

Again I haven't used SSH tunneling much as I prefer openvpn, so I need to try to have a play again soon to refresh myself. So im hoping others will step in to clarify all this, but maybe this helps you in the mean time.