Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two servers which communicate over http. I wish this transfer be secure.

How can this be achieved? I do not wish to use use https (that would require ssl certificate,right?)

[SERVER-I] --> [SSH-ENDPOINT] -<->--<->--<->-HTTP-<->--<->--<->- [SSH-ENDPOINT] <--[SERVER-II]

Is something like this ^^ possible?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

All is possible ! ssh -C -L 8080:server-II:80 SSH-ENPOINT will established a tunnel between ssh_endpoints. Then you can ask to your server to connect to the other by using http://localhost:8080. To the other way, you need another tunnel.

share|improve this answer
    
I'm not sure if I understoodd this "To the other way, you need another tunnel". Can you please explain a bit? –  kapeels Oct 5 '11 at 6:12
    
If the second server need to talk to the first by a secured connection, you need to establish this connection too, by ssh -C -L 8080:server-I:80 SSH-ENPOINT-I –  Dom Oct 5 '11 at 12:04

If your problem with using an SSL certificate is that they cost money, self-signed certificates are free and provide exactly the same encryption. Tutorials are easy to find.

If you are using curl, you can use the -k option to not require that your server's SSL key is signed by a CA. The wget version of this option is --no-check-certificate.

Dom's solution will work however you will need to stay logged in or disown the ssh process from the current shell or else the tunnel will go away when you disconnect.

One method is to use nohup in front of the ssh command.

Another is to background the ssh process and then disown it. You can background an ssh connection by typing ~^z (That's a tilde followed by a ctrl-z) then use bg to start it running again in the background and disown to separate the ssh tunnel from the shell.

I'm not sure exactly how that escape sequence works with chained ssh connections. I suspect you will need to type ~~^z if you have used ssh to connect to server1 before using ssh to set up a tunnel between the two servers.

You may also want to use something like Autossh to restart the tunnel if it dies. Firewalls and random network outages can easily cause the tunnel to break even if the process is still alive.

share|improve this answer
2  
+1 for the self-signed cert idea. For internal server-server communication that's a pretty perfect solution. On top of that, if you need a paid one, GoDaddy sells them for $13/year. –  ceejayoz Oct 1 '11 at 18:26

I would look into something like a secure VPN connection between the two servers. I've played around with having hamachi (http://www.logmein.com) installed on both servers. I was able to create a secure VPN connection between the two servers without opening up any risks of having ports opened for the VPN communication. By default the Hamachi VPN tun adapter is 100mbps which is usually okay, but could be an issue of you need something greater than that. Hamachi is also cross platform and very easy to setup.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.