Skip to content

Instantly share code, notes, and snippets.

@shakibamoshiri
Forked from bwann/README.md
Created January 13, 2024 13:53
Show Gist options
  • Save shakibamoshiri/485842657a2e6fbe4f3c84a775813c87 to your computer and use it in GitHub Desktop.
Save shakibamoshiri/485842657a2e6fbe4f3c84a775813c87 to your computer and use it in GitHub Desktop.
Tunnelling SSH over SSL/TLS

How to tunnel SSH over SSL/TLS

laptop ssh -> laptop stunnel -> evil network -> internet -> your server -> your server ssh

Server (your shell server/home box/work box/whatever)

Sets up a stunnel process listening externally on port 2443/tcp, forwards to localhost 22/tcp

  • Install stunnel, e.g. yum install stunnel
  • Install server config snippet to /etc/stunnel/stunnel.conf
  • Create a TLS cert+key pair, save to /etc/stunnel/stunnel.pem

Quick and dirty self signed cert, if you don't care about repudiation: openssl req -new -x509 -days 365 -nodes -out stunnel.pem -keyout stunnel.pem

  • Create the chroot directory: mkdir /var/run/stunnel ; chown nobody.nobody /var/run/stunnel
  • Run the server: stunnel /etc/stunnel/stunnel.conf if there isn't an init script
  • Remember to open iptables to accept connections on 2443/tcp if you use it!

Client/laptop

Sets up a stunnel process listening on the laptop on port 2443

  • Install stunnel
  • Install client config to your homedir as stunnel-client.conf
  • Edit connect= line to change to the name/address of your server, e.g. connect=myserver.example.com:2443
  • Run the client: stunnel stunnel-client.conf

Testing/verification

From laptop, telnet to localhost port 2443. You should see the OpenSSH banner of your remote server

lapdance:~ bwann$ telnet localhost 2443
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-OpenSSH_6.6.1

Testing ssh:

lapdance:~ bwann$ ssh -p 2443 localhost uname -n
my-server.wann.net

Usage

On your laptop, ssh to localhost port 443. This will connect you to the sshd running on your server. Done!

ssh -p 4443 localhost

pid = /tmp/stunnel.pid
client=yes
[ssh]
accept=2443
connect=my-server.wann.net:2443
cert = /etc/stunnel/stunnel.pem
sslVersion = TLSv1
options = NO_SSLv2
options = NO_SSLv3
chroot = /var/run/stunnel
setuid = nobody
setgid = nobody
pid = /stunnel.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
[sshd]
accept = 2443
connect = 22
TIMEOUTclose = 0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment