Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two web servers each with a public IP that make outbound SFTP connections to various SFTP servers to update content. I would like to setup a Forward proxy for SFTP outbound connections. Does such a proxy exist?

share|improve this question
    
But... why??? –  womble Aug 3 '11 at 8:13

1 Answer 1

You can proxy SSH connections (and thus also SFTP which is encapsulated within a SSH connection) by using a generic SOCKS proxy. I am not aware of any protocol-specific proxies for SSH/SFTP.

(It would be easier to answer if you gave a hint about your ultimate objective. What is the purpose of wanting to have the proxy?)

UPDATE

Using SSH to tunnel SSH through a proxy:

  1. Install tsocks on the clients which are initiating the SFTP connections.

  2. In your /etc/tsocks.conf set the following:

    server = 127.0.0.1
    server_type = 5
    server_port = 1080
    
  3. Open a background SSH connection to your SFTP proxy machine as follows:

    ssh -D 1080 -f -n -N ssh-proxy.example.com
    

    ...or if you want it to close automatically after 5 minutes:

    ssh -D 1080 -f -n ssh-proxy.example.com 'sleep 300'
    

    (If you do this from a script, you probably need to add -i keyfile in the client and a put a corresponding entry in ~/.ssh/authorized_keys in the SFTP proxy server if you want to open the connection from a script without user attention.)

  4. Run the SFTP operations through the proxy by using the tsocks wrapper:

    tsocks sftp destination-host.example.com
    

    (This SFTP connection will look in destination-host.example.com as if it was initiated from ssh-proxy.example.com.)

Alternative method with Dante:

Alternatively you could install dante-server (a SOCKS proxy server software) on the proxy machine and configure your /etc/tsocks.conf to connect there instead of 127.0.0.1. Then just run your SFTP operations with the tsocks wrapper as in the step 4 above. If you do this, you need to make sure that the dante server is configured so that it does not allow connections from unauthorized users.

Hope this helps!

share|improve this answer
    
My goal is to have all outbound SFTP connections look like they came from the same public IP, instead from the Public IP of the Web server that served the outbound SFTP connection. –  Brian Scott Aug 3 '11 at 16:03
    
Thanks for the clarification. I will update my answer. –  snap Aug 3 '11 at 16:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.