Hot answers tagged

20

The close the loop here. The answer, in this case, was to force the ssh client to use ipv4. E.g. ssh -4 -D 8081 user@8.8.8.8


9

By far, the easiest way is to just copy it via scp. Plus, this syntax actually works unlike some of the other suggestions. You can't beat this syntax for ease. It allows you to recursively copy, rsync or what ever you'd like without the hassle of considering potentially complex pipes. This syntax is intuitively clear, will be more readily supportable ...


6

If I'm not mistaken, SIT is symmetrical: the same thing is done on both sides. Configuration should be pretty straightforward: Cisco IOS: interface Tunnel0 description 6in4 to <client> no ip address ipv6 enable ipv6 address 2001:db8:::1/64 tunnel source <local ipv4> tunnel destination <client ipv4 addr> tunnel mode ipv6ip ...


6

The parameters are basically the same (autossh passes them directly to ssh). Remove -f if you don't want autossh to background itself. You probably want the -N option to not execute a shell on the server. Select a free port for the -M option (the port one above that must also be free). On Debian/Ubuntu you can omit this because the package includes a wrapper ...


5

I ended up going with the Ethernet bridging. Lots of extremely verbose examples to wade through online, but it turns out to be pretty easy: First, on A, /etc/network/interfaces was changed from: auto eth0 iface eth0 inet static address 8.8.8.122 netmask 255.255.255.248 gateway 8.8.8.121 to: auto br0 iface br0 inet static address ...


5

PIPES! If the internet is a series of tubes, Unix is a series of pipes -- something like: cat ginormous-file | ssh user@host1 "cat | ssh user@host2 \"cat >out\" " should work. If you need to traverse more hosts, add more pipes (and more nested layers of \-escaped quotation) as needed. (Note however that if the pipeline/escaping gets so complex that ...


4

The Teredo tunneling protocol will likely do what you want, but you have to work with the protocol in picking addresses; the same is true of 6to4. You have picked your IPv6 addresses out of the air. The old IPv4 concept, of some private (RFC1918) address ranges which were globally unroutable but anyone could use (including over multiple sites, as long as ...


4

SSH tunnel isn't really a great idea as a permanent solution. SSH is TCP based. Most things you can tunnel within SSH is TCP based (including mysql). Tunneling TCP over TCP can have performance implications. Because your system will try to handle the backoff and such on both connections at the same time. If you want a secure permanent connection between ...


4

When you do ssh tunnel it make a encrypted communication between your system to remote server and bind the remote opened port to your defined port. ssh -L 33333:localhost:3306 fakeuser@server.remote.com here 3306 as you said is mysql port no. use IPADDRESS instead of localhost i.e 127.0.0.1 Connection to 10.10.0.31 closed. linux@tuxworld:~$ ssh -fNg -L ...


4

See man ssh: -N Do not execute a remote command. This is useful for just forwarding ports (protocol version 2 only). So, use ssh -N -L 3307:127.0.0.1:3306 remoteserver Not having a shell with password-based login is not normal, are you sure you didn't change something else as well?


4

What you really need to do is send the traffic over some sort of private network. It's really quite expensive to build your own private wide-area network, so it'd be good if we could utilise the Internet somehow... but then, the private network wouldn't be a physical one, but would instead be "virtual". In fact, that sounds like a really snappy name for a ...


3

I agree with CanOfSpam3 that using -D8080 is a better option then setting up a proxy with Apache. However, to answer your question, I would guess you have missed the Listen line in Apache to listen to port 8080 in addition to the usual ones. <VirtualHost> alone does not make Apache listen to the IP:Port mentioned, you also need to ask Apache to listen ...


3

From OpenVPN's perspective there's no difference between a site-to-site and client-to-site connection, it's just a matter of the configuration you want. You need to decide whether you can support both with a single server instance, or whether you need two server instances running on different ports. A site-to-site VPN will typically have iroute directives ...


3

Bind your NAT rule to the IP address openvpn is listening on. Your current rule is intercepting all traffic going through the server with a destination port of 53 (in this case, traffic traversing your tun interface). Always try to make your rules as specific as possible; if you don't, weird things like this will happen. Try something like this: iptables ...


3

The autossh utility may do what you want autossh is a program to start a copy of ssh and monitor it, restarting it as necessary should it die or stop passing traffic. You should really do the job correctly and create a VPN between the two systems using openvpn (or similar).


3

What you want is not a reverse tunnel but a regular tunnel. ssh -L 80:someserver.com:80 user@myserver This will create a listening socket on port 80 of your laptop (localhost) that will go to someserver.com through the SSH server on myserver. I usually combine tunnels with the options -CfN, -C will enable compression (speeds things up a bit), -f sends ...


3

On win7 machine, open putty and set the following settings for the linux ssh session: Connection->SSH->Tunnels->Source port: 1433, Destination: 192.168.0.3:1433, select local radio button. Now you should be able to connect to localhost:1433 from the win7 machine.


3

Do you have an existing monitoring platform? For VPN tunnels, I tend not to trigger alerts from the endpoint firewalls (e.g. SNMP), but monitor different sides of the link... A ping check from your monitoring solution is pretty darn good for this, as the tunnel will either be up and passing traffic or down. Despite this, you can configure email alerts for ...


3

as noted in the updates to the question, the problem is that after the kernel passes the packet to whatever raw sockets are listening on that protocol, it then hands it off to any kernel modules registered for that same protocol. since I had been using a sit tunnel on my netbook, the tunnel4 module was still loaded even though I had temporarily set up the ...


2

I went throught this article to get a better understanding of what your configuration is. Your local computer (or the server from which the tunnel will be initiated) should be listed in "Endpoint 1" as well "local Tunnel Computer". The "remote tunnel computer" box should have the IP address of your router where the tunnel is terminated. The servers that you ...


2

You can change your HELO policy to: smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname ...and add your home mail server's address to mynetworks = ... line. Although the answer by @JennyD is valid and should solve your problem, it can be better to keep ...


2

I think all that's needed to is to change -R 2200:localhost:2200 to -R 2200:localhost:22 in your ssh command. As it stands, you're connecting port 2200 on the server back to port 2200 on the client. And yes, that creates a forwarding loop since client:2200 is tunneled back to the server. Assuming ssh on the client is running on port 22, then -R ...


2

Why not install a persistant reverse_http(s) meterpreter on the "dropbox"? I think this is the easiest way to acquire a reverse shell over http(s).


2

Use a proxy server installed on either server 1 or 3, configured to allow connections to the sites in sources.list from the private network servers. As a bonus, if you go with a caching proxy like squid or approx you'll use less bandwidth for downloading packages common to the servers. For regular web proxies like squid, you can either set the $http_proxy ...


2

You are trying to make this more complicated then it needs to be. Put in the IP of server C instead of localhost. ssh -L 4321:172.26.15.16:4321 The -L option [localaddress:]localport:remoteaddress:remoteport [localaddress:] (Optional specify the local IP SSH will bind to. By default it will bind to all IPs. localport the local TCP port that SSH will ...


2

If you want to require authentication, then you should probably drop the -g option to make the tunnel available to the network. Then require everyone who needs access to the tunnel to the remote system establish a connection to your SSH server with a tunnel. How can I get the Linux server to prompt for username/password when connecting to the tunnel ...


2

Use redirect-private, but also add route per every network you want to route through VPN. Btw note that DNS setting on other interfaces will stop work, when that interface will not have route to its DNS servers. This is what happens when redirect-gateway drops default gateway from your (W)LAN interface and adds host route to VPN server IP through original ...


2

ifconfig -a shows the interface. You need to use -a to see interfaces that are down. ifconfig alone only shows interfaces that are up.


2

You are probably running the command in root's crontab (did you edit the crontab file in super user mode - i.e. did you edit the crontab prepending sudo ?). If that is the case then the host verification keys should be located in your super user's /root/.ssh/ directory, instead of yours.



Only top voted, non community-wiki answers of a minimum length are eligible