[SOLVED] IPTables, allow ssh tunneling?

JamesGT · 07-13-2014, 04:16 PM

I have a server out on the internet with Slackware 14.1. I set up the ssh security as per this URL:

http://docs.slackware.com/howtos:security:ssh

I'd like to modify the part about ssh_hide so it will allow ssh tunneling on a specific port, how would I do that?

When I disable the ssh_hide script, I can easily do tunneling on the port I would like, but when in use, I can not. What do I need to modify to allow ssh tunneling on a specific port?

keefaz · 07-13-2014, 06:16 PM

You can't access the server to ports 99,88 or 8889 ?

JamesGT · 07-13-2014, 07:19 PM

Quote:

Originally Posted by keefaz

You can't access the server to ports 99,88 or 8889 ?

I can, but I can't use tunneling, it denies access.

ReaperX7 · 07-13-2014, 08:08 PM

Check sshd_config for the tunneling option, you may have to enable it there and then restart the service.

JamesGT · 07-13-2014, 09:48 PM

Quote:

Originally Posted by ReaperX7

Check sshd_config for the tunneling option, you may have to enable it there and then restart the service.

If I remove the ssh_hide file, and remove the reference from rc.local, it works as it should. If I re-enable that file and code, tunneling stops. I can still connect via ssh, but I can't tunnel, it doesn't allow me to connect at all. It is denied.

keefaz · 07-14-2014, 04:00 AM

Could you post an example of the ssh command you use for tunnelling ?

JamesGT · 07-14-2014, 08:24 AM

Quote:

Originally Posted by keefaz

Could you post an example of the ssh command you use for tunnelling ?

ssh -D 1080 username@123.456.789.012

keefaz · 07-14-2014, 12:54 PM

did you try adding the destination port eg:
ssh -D 1080 username@123.456.789.012:8889

JamesGT · 07-14-2014, 03:12 PM

Quote:

Originally Posted by keefaz

did you try adding the destination port eg:
ssh -D 1080 username@123.456.789.012:8889

When I try that, I get...

"ssh: Could not resolve hostname 123.456.789.012:1080: Name or service not known"

If I try it without the :1080 I get...

"ssh: connect to host 123.456.789.012 port 22: Connection refused"

If I use "ssh -p 1080 username@123.456.789.012", I connect.

michaelk · 07-14-2014, 04:38 PM

Quote:

ssh -D 1080 username@123.456.789.012:8889

Wrong syntax. If you use a port other then 22 (default) then you need to use the -p switch (or set the value in ~/.ssh/config file)

The firewall rules in the posted how-to basically forwards ssh traffic from port 8889 to 22 so you need to use the syntax

ssh -p 8889 username@xxx.xxx.xxx.xxx

Since 1080 works did you modify the script to use 1080 instead of 8889? If you want to use dynamic tunnelling then:

ssh -D xxxx -p 8889 username@xxx.xxx.xxx.xxx

JamesGT · 07-14-2014, 06:51 PM

Quote:

Originally Posted by michaelk

ssh -D xxxx -p 8889 username@xxx.xxx.xxx.xxx

Worked as it should! Sweet! Thank you very much!

James