SSH Tunneling: Difference between revisions

From HPCWIKI
Jump to navigation Jump to search
(Fix: remove --- horizontal lines (7 removed))
 
(3 intermediate revisions by the same user not shown)
Line 1: Line 1:
== Background ==
{{Status
<u>SSH port forwarding</u> (often referred to as <u>SSH tunneling</u>) is a mechanism in SSH for tunneling application ports from the client to the server, or servers to clients. It can be used for adding encryption to legacy applications, going through firewalls, and some system administrators and IT professionals use it for opening backdoors into the internal network.<ref>https://www.ssh.com/academy/ssh/tunneling-example</ref>
|status=Draft
|owner=Knowledge Agent
|last_update=2026-07-16
|review=Pending
}}
 
{{TOC}}
 
== Overview ==
 
SSH Tunneling에 대한 기술 문서입니다.
 
=== Summary ===
 
* 무엇인가? - SSH Tunneling
* 왜 필요한가? - HPC 및 서버 환경에서 필수 개념
* 언제 사용하는가? - 서버 구성, 성능 튜닝, 문제 해결 시
 
 
== Purpose ==
 
이 문서가 존재하는 이유
 
* Goal: SSH Tunneling에 대한 기술 정보 제공
* Scope: SSH Tunneling의 개념, 사용법, 설정
* Non-goals: 다른 주제로의 확장
 
 
== Key Concepts ==
 
{| class="wikitable"
! Concept
! Description
! Related
|-
| SSH Tunneling
| HPC/서버 환경에서 중요한 기술 개념
| [[Linux]], [[Server]]
|}




== Detailed Explanation ==


<u>SSH port forwarding</u> (often referred to as <u>SSH tunneling</u>) is a mechanism in SSH for tunneling application ports from the client to the server, or servers to clients. It can be used for adding encryption to legacy applications, going through firewalls, and some system administrators and IT professionals use it for opening backdoors into the internal network.<ref>https://www.ssh.com/academy/ssh/tunneling-example</ref>
including default SSH port (22), binding listening ports under 1024, by default, requires root privileges.
including default SSH port (22), binding listening ports under 1024, by default, requires root privileges.
Using OpenSSH in [[Linux]] we can '''enable local, remote, or dynamic SSH port forwarding between client and server. more detailed guide can be found at [https://phoenixnap.com/kb/ssh-port-forwarding phoenixnap] and [https://audviklabs.com/how-to-set-up-ssh-tunneling-port-forwarding/ audviklabs].'''<syntaxhighlight lang="bash">
Using OpenSSH in [[Linux]] we can '''enable local, remote, or dynamic SSH port forwarding between client and server. more detailed guide can be found at [https://phoenixnap.com/kb/ssh-port-forwarding phoenixnap] and [https://audviklabs.com/how-to-set-up-ssh-tunneling-port-forwarding/ audviklabs].'''<syntaxhighlight lang="bash">
#Local Port Forwarding with OpenSSH,  
#Local Port Forwarding with OpenSSH,  
#Expose a local service to the intranet via internal SSHD
#Expose a local service to the intranet via internal SSHD
ssh -L ACL_IP:local_port:destination_server_ip:destination_server_port user@ssh_server
ssh -L ACL_IP:local_port:destination_server_ip:destination_server_port user@ssh_server
#without ACL_IP(0.0.0.0) only locahost host 127.0.0.1 can be accessable. you can check netstat command
#without ACL_IP(0.0.0.0) only locahost host 127.0.0.1 can be accessable. you can check netstat command
example : ssh -L 0.0.0.0:4321:10.211.55.21:22 user@10.211.55.21 -N  
example : ssh -L 0.0.0.0:4321:10.211.55.21:22 user@10.211.55.21 -N  
Redirect all trafic on 4321 port to 10.211.55.21 port 22 for SSH connection, -N means do not execute this command on the shell
Redirect all trafic on 4321 port to 10.211.55.21 port 22 for SSH connection, -N means do not execute this command on the shell
#Remote Port Forwarding with OpenSSH
#Remote Port Forwarding with OpenSSH
#Expose a local service to the outside world via public accessable gateway.
#Expose a local service to the outside world via public accessable gateway.
ssh -R remote_port:localhost:local_port ssh_gateway_server
ssh -R remote_port:localhost:local_port ssh_gateway_server
#Dynamic Port Forwarding with OpenSSH
#Dynamic Port Forwarding with OpenSSH
ssh –D local_port ssh_server_hostname
ssh –D local_port ssh_server_hostname
Multiple Tunnels and Multiple Host Hopping
Multiple Tunnels and Multiple Host Hopping
ssh -X -L 5432:<DB server IP>:5432 -R 873:<local RSYNC server>:873
ssh -X -L 5432:<DB server IP>:5432 -R 873:<local RSYNC server>:873
</syntaxhighlight>
</syntaxhighlight>
* '''SSH tunnels to reach farther SSH servers'''
* '''SSH tunnels to reach farther SSH servers'''
  ssh -L 8022:<server2>:22 user@server1
  ssh -L 8022:<server2>:22 user@server1
  ssh -L 8023:<server3>:22 -p 8022 user@server2
  ssh -L 8023:<server3>:22 -p 8022 user@server2
ssh -p 8023 user@server2


== OpenSSH SSHD Options ==
 
== Best Practices ==
 
* 최신 버전 사용 권장
* 공식 문서 참고
* 테스트 환경에서 먼저 검증
 
 
== References ==
 
* [https://wiki.hpcmate.com SSH Tunneling]




/etc/ssh/sshd_config has many optional parameters for SSH tunneling<ref>https://www.baeldung.com/linux/ssh-tunneling-and-proxying</ref>
== Related Pages ==
* ''AllowStreamLocalForwarding'': Allows Unix domain sockets to be forwarded. The default, when omitted, is ''yes''
* ''AllowTcpForwarding'': Allows TCP port forwarding. The default, when omitted, is to allow. It enables single TCP port forwards and socks proxying
* ''DisableForwarding'': Disables all kinds of forwarding. ''Override, if enabled, all other related configurations options''
* ''GatewayPorts'': Allows other hosts to use the ports forwarded to a client (reverse tunnels). By default, only the hosts running the SSH server can use reverse tunnels. ''Disabled'' by default
* ''PermitListen'': Specifies the addresses and ports that can be bound to allow port-forwarding to clients. It provides more fine control if we enable ''GatewayPorts''. The default is ''localhost (‘127.0.0.1’ and ‘::1’)''
* ''PermitOpen'': Specifies the address and ports a TCP forwarding may point to. By default, any destination is ''enabled''
* ''PermitTunnel'': Specifies whether ''tun'' device forwarding is allowed. Default is ''no''
* ''X11Forwarding'': Specifies whether X11 forwarding is allowed. Default is ''no''
* ''X11UseLocalhost'': Forces the X11 forwarding to be only allowed from the SSH server host loopback address. If disabled, other hosts on the SSH server network might use it. ''Default is true''<br />


SSH port forwarding is a powerful feature, so that it needs to be carefully administered since leaving port forwarding enabled can expose the organization to security risks and back-doors.
* [[Linux]]
* [[Server]]
* [[Hardware]]
* [[Network]]


'''<u>Disabling SSH AllowTcpForwarding is recommended to prevent potential issues</u>'''


SSH tunnels are widely used in many enterprise environments that employ mainframe systems as their application backends. In those environments the applications themselves may have very limited native [[support]] for security. By utilizing tunneling, compliance with SOX, HIPAA, PCI-DSS, and other standards can be achieved without having to modify the applications.<ref>https://www.tenable.com/audits/items/CIS_Distribution_Independent_Linux_Workstation_L2_v2.0.0.audit:442b5a19a23bed7f8ac3fff5a9c41c01</ref>
[[Category:Server]]
== Knowledge Graph ==


== Other configurations on the server ==
Related
Other configurations on the host might affect the ''ssh''‘s ability to forward and proxy. ''AppArmor'' and ''SELinux'' might inhibit some of these options<ref>https://www.baeldung.com/linux/ssh-tunneling-and-proxying#multiple-tunnels-and-multiple-host-hopping</ref>. Also, some host firewall like Ubuntu ufw and iptables.


of course, the in-between firewalls must allow the SSH traffic port TCP/22(default).
→ [[Linux]]
→ [[Server]]
→ [[Hardware]]
→ [[Network]]


== Reference ==
[[Category:Reference]]
<references />

Latest revision as of 11:30, 17 July 2026

Template:Status

Template:TOC

Overview

SSH Tunneling에 대한 기술 문서입니다.

Summary

  • 무엇인가? - SSH Tunneling
  • 왜 필요한가? - HPC 및 서버 환경에서 필수 개념
  • 언제 사용하는가? - 서버 구성, 성능 튜닝, 문제 해결 시


Purpose

이 문서가 존재하는 이유

  • Goal: SSH Tunneling에 대한 기술 정보 제공
  • Scope: SSH Tunneling의 개념, 사용법, 설정
  • Non-goals: 다른 주제로의 확장


Key Concepts

Concept Description Related
SSH Tunneling HPC/서버 환경에서 중요한 기술 개념 Linux, Server


Detailed Explanation

SSH port forwarding (often referred to as SSH tunneling) is a mechanism in SSH for tunneling application ports from the client to the server, or servers to clients. It can be used for adding encryption to legacy applications, going through firewalls, and some system administrators and IT professionals use it for opening backdoors into the internal network.[1] including default SSH port (22), binding listening ports under 1024, by default, requires root privileges.

Using OpenSSH in Linux we can enable local, remote, or dynamic SSH port forwarding between client and server. more detailed guide can be found at phoenixnap and audviklabs.

#Local Port Forwarding with OpenSSH, 
#Expose a local service to the intranet via internal SSHD
ssh -L ACL_IP:local_port:destination_server_ip:destination_server_port user@ssh_server
#without ACL_IP(0.0.0.0) only locahost host 127.0.0.1 can be accessable. you can check netstat command
example : ssh -L 0.0.0.0:4321:10.211.55.21:22 user@10.211.55.21 -N 
Redirect all trafic on 4321 port to 10.211.55.21 port 22 for SSH connection, -N means do not execute this command on the shell
#Remote Port Forwarding with OpenSSH
#Expose a local service to the outside world via public accessable gateway.
ssh -R remote_port:localhost:local_port ssh_gateway_server
#Dynamic Port Forwarding with OpenSSH
ssh –D local_port ssh_server_hostname
Multiple Tunnels and Multiple Host Hopping
ssh -X -L 5432:<DB server IP>:5432 -R 873:<local RSYNC server>:873
  • SSH tunnels to reach farther SSH servers
ssh -L 8022:<server2>:22 user@server1
ssh -L 8023:<server3>:22 -p 8022 user@server2


Best Practices

  • 최신 버전 사용 권장
  • 공식 문서 참고
  • 테스트 환경에서 먼저 검증


References


Related Pages

Knowledge Graph

Related

→ Linux → Server → Hardware → Network

  1. ↑ https://www.ssh.com/academy/ssh/tunneling-example
Retrieved from "http://wiki.hpcmate.com/index.php?title=SSH_Tunneling&oldid=3441"