{"id":344,"date":"2015-06-29T04:50:12","date_gmt":"2015-06-29T04:50:12","guid":{"rendered":"https:\/\/www.eskimo.com\/support\/?page_id=344"},"modified":"2016-05-24T21:22:33","modified_gmt":"2016-05-24T21:22:33","slug":"ssh-forwarding","status":"publish","type":"page","link":"https:\/\/www.eskimo.com\/support\/using-linux\/ssh-forwarding\/","title":{"rendered":"SSH Forwarding"},"content":{"rendered":"

SSH Port Forwarding<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0 SSH port forwarding is a method of allowing secure, encrypted connections <\/span>to traditionally non-encrypted services, such as POP3 for email, NNTP for <\/span>news, and even Telnet for remote hosts without their own SSH encrypted access.<\/span><\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0 With this method of connecting to the servers, you would open a SSH connection to <\/span>“tunnel” a local port to a remote server’s port, then set your application <\/span>software to connect to your own local port. This way, any passwords or data being <\/span>transmitted at your own location (a wireless access point for instance) would be <\/span>sent over the encrypted SSH connection rather than out in the “open” (though the <\/span>final server-to-server step is indeed unencrypted by the nature of the forwarded <\/span>protocols).<\/span><\/span><\/p>\n

Port Forwarding on Unix\u00ae Machines<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0 The Mac OS X, Linux, UNIX, and similar systems, including <\/span>Cygwin<\/a> for Windows\u00ae, provide the same <\/span>interface for accessing the ssh command, so the instructions for these <\/span>environments are identical:<\/span><\/span><\/p>\n

\n\n\n\n\n\n\n\n\n
ssh \u00a0 -L \u00a0 LPORT\u00a0 <\/span>RHOST<\/span>:RPORT<\/span> \u00a0 SSHHOST<\/span><\/span><\/td>\n<\/tr>\n
Where…<\/span><\/td>\n<\/tr>\n
LPORT<\/span><\/td>\n=<\/span><\/td>\nLocal Port, a port on your machine<\/span><\/td>\n<\/tr>\n
RHOST<\/span><\/td>\n=<\/span><\/td>\nRemote Host, server to connect to<\/span><\/td>\n<\/tr>\n
RPORT<\/span><\/td>\n=<\/span><\/td>\nRemote Port, port on the remote host<\/span><\/td>\n<\/tr>\n
SSHHOST<\/span><\/td>\n=<\/span><\/td>\nSSH Host; “eskimo.com” for our customers.<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\u00a0\u00a0\u00a0\u00a0 Unix-based servers require “root” permissions to forward locally privileged <\/span>ports (usually 0-1023), so setting up ports outside this range under a <\/span>regular user’s permissions is better for your system’s security. Also using <\/span>non-standard ports locally may help avoid software infections from abusing your <\/span>forwards.<\/span><\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0 While it’s more secure to only have actively-used ports open at any given <\/span>time, any number of forwards can be setup on a single connection. For instance, <\/span>to only open a secure POP3 port on mail.eskimo.com:<\/span><\/span><\/p>\n

\n\n\n\n
ssh \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 -L<\/span>\u00a0 5110<\/span>:mail.eskimo.com<\/span>:110 <\/span><\/span>eskimo.com<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\u00a0\u00a0\u00a0\u00a0 To open both POP3 and NNTP in the same manner:<\/span><\/p>\n

\n\n\n\n\n
ssh<\/span><\/td>\n-L \u00a0 5110<\/span>:mail.eskimo.com<\/span>:110<\/span> \u00a0 \\<\/span><\/td>\n<\/tr>\n
\u00a0<\/span><\/td>\n-L \u00a0 5119<\/span>:news.eskimo.com<\/span>:119 <\/span><\/span>eskimo.com<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\u00a0\u00a0\u00a0\u00a0 You can verify that the ports have been opened for forwarding by adding ‘-v’ <\/span>(for ‘verbose’) to the ssh arguments:<\/span><\/span><\/p>\n

\n\n\n\n
ssh \u00a0 -L \u00a0 5110<\/span>:mail.eskimo.com<\/span>:110<\/span><\/span>
\n -L \u00a0 5119<\/span>:news.eskimo.com<\/span>:119 <\/span><\/span>-v \u00a0 eskimo.com<\/span><\/span>…eskimo.com: Connections to local port 5110 forwarded to remote address pop3.eskimo.com:110 eskimo.com: Connections to local port 5119 forwarded to remote address news.eskimo.com:119…<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\u00a0<\/span><\/p>\n

Scroll below to “Using Forwarded Ports”.<\/span><\/p>\n

\n

Port Forwarding on Windows\u00ae Machines<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0 The steps above will configure the Cygwin <\/a><\/span>environment. For others, using the same example port numbers and servers as above, <\/span>two common applications are PuTTY and TeraTerm Pro (both free). Others may be <\/span>available with similar configuration terms to find in their documentation.<\/span><\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0 P<\/span>u<\/span>TTY<\/span><\/a>:<\/b><\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0 Before starting the SSH connection to eskimo.com, go to the “Tunnels” panel <\/span>(within “Connection \/ SSH” in case it’s collapsed to “[+]” expandable lists), <\/span>make sure the “Local” option is selected (currently on the bottom of the window), <\/span>and for an NNTP example forward, use:<\/span><\/span><\/p>\n

\n\n\n\n\n
Source Port:<\/span><\/td>\n5119<\/span><\/td>\n<\/tr>\n
Destination:<\/span><\/td>\nnews.eskimo.com:119<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\u00a0\u00a0\u00a0\u00a0 Click “Add” to add this to the configured tunnels\/forwards. The screen below <\/span>shows both the typed and added versions:<\/span><\/span><\/p>\n

\"putty_tunnels\"<\/span><\/div>\n

\u00a0\u00a0\u00a0\u00a0 Back in the “Session” portion (currently the top selection in the list) <\/span>preconfigured sessions can be saved for future use before connecting by <\/span>typing a name and choosing ‘Save’. Below, there are both standard non-tunnelled <\/span>SSH and NNTP-tunnelled saved SSH sessions. Saved sessions can be started with a <\/span>double-click on the appropriate name.<\/span><\/span><\/p>\n

\"putty_session\"<\/span><\/div>\n

\u00a0\u00a0\u00a0\u00a0 When your session is connected and logged in, you can right-click the title <\/span>bar of PuTTY’s window and select “Event Log” to verify that the forward has <\/span>been setup:<\/span><\/span><\/p>\n

\n\n\n\n
…(date and time) Local port 5119 forwarding to news.eskimo.com:119…<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\u00a0<\/span><\/p>\n

TeraTerm Pro<\/a> with SSH Extension:<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0 “ttssh<\/strong>” uses a command line system similar to the Unix method shown above, with a slightly different argument set:<\/span><\/p>\n

ttssh<\/span>
\n eskimo.com<\/span>:22<\/span>
\n \/ssh-L5110<\/span>:mail.eskimo.com<\/span>:110<\/span><\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0 Notice that ‘-L’ has become ‘\/ssh-L’ and there is no space between it and the port information. Also be sure you specify port 22 (ssh) on eskimo.com<\/span>. The order of the arguments may be needed as shown above (I’ll check on that…order may not be required).<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0 Alternatively, you can use the configuration window listed under Setup \/ SSH Forwarding<\/strong>.<\/span><\/p>\n

\n

Using Forwarded Ports<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0 Using these forwards requires setting your software’s preferences <\/span>to use the appropriate local ports instead of the unencrypted originals. <\/span>For example, using Mozilla Thunderbird’s mail and news settings:<\/span><\/span><\/p>\n

\n\n\n\n\n\n\n\n
Instead of…<\/span><\/td>\nIncoming Mail:<\/span><\/td>\nmail.eskimo.com<\/span>, port 110<\/span><\/span><\/td>\n<\/tr>\n
Use…<\/span><\/td>\nIncoming Mail:<\/span><\/td>\nlocalhost<\/span>, port 5110<\/span><\/span><\/td>\n<\/tr>\n
\u00a0<\/span><\/td>\n<\/tr>\n
Instead of…<\/span><\/td>\nNewsgroups:<\/span><\/td>\nnews.eskimo.com<\/span>, port 119<\/span><\/span><\/td>\n<\/tr>\n
Use…<\/span><\/td>\nNewsgroups:<\/span><\/td>\nlocalhost<\/span>, port<\/span> 5119<\/span><\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\u00a0<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0 Services that could be forwarded for this reason may be anything that <\/span>requires username\/password authentication (email and news examples are <\/span>unencrypted once sent\/posted, but your own password is secured) or <\/span>otherwise single-port unencrypted connections, including:<\/span><\/span><\/p>\n

\n\n\n\n\n\n\n
Common\u00a0Servers\u00a0and\u00a0Ports<\/span><\/caption>\n
Telnet<\/span><\/td>\n…elsewhere…<\/span><\/td>\n23<\/span><\/td>\n<\/tr>\n
SMTP<\/span><\/td>\nmail.eskimo.com<\/span><\/td>\n25<\/span><\/td>\n<\/tr>\n
POP3<\/span><\/td>\nmail.eskimo.com<\/span><\/td>\n110<\/span><\/td>\n<\/tr>\n
NNTP<\/span><\/td>\nnews.eskimo.com<\/span><\/td>\n119<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\u00a0<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0 We do offer SSL-encrypted POP3 here as well; this forwarding version could be <\/span>useful where that is not available.<\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

SSH Port Forwarding \u00a0\u00a0\u00a0\u00a0 SSH port forwarding is a method of allowing secure, encrypted connections to traditionally non-encrypted services, such as POP3 for email, NNTP for news, and even Telnet for remote hosts without their own SSH encrypted access. \u00a0\u00a0\u00a0\u00a0 … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":761,"menu_order":0,"comment_status":"open","ping_status":"open","template":"showcase.php","meta":{"footnotes":""},"class_list":["post-344","page","type-page","status-publish","hentry","wpautop"],"_links":{"self":[{"href":"https:\/\/www.eskimo.com\/support\/wp-json\/wp\/v2\/pages\/344","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.eskimo.com\/support\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.eskimo.com\/support\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.eskimo.com\/support\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.eskimo.com\/support\/wp-json\/wp\/v2\/comments?post=344"}],"version-history":[{"count":2,"href":"https:\/\/www.eskimo.com\/support\/wp-json\/wp\/v2\/pages\/344\/revisions"}],"predecessor-version":[{"id":983,"href":"https:\/\/www.eskimo.com\/support\/wp-json\/wp\/v2\/pages\/344\/revisions\/983"}],"up":[{"embeddable":true,"href":"https:\/\/www.eskimo.com\/support\/wp-json\/wp\/v2\/pages\/761"}],"wp:attachment":[{"href":"https:\/\/www.eskimo.com\/support\/wp-json\/wp\/v2\/media?parent=344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}