Hot answers tagged

31

SSLv2 and SSLv3 are completely different (and both are now considered insecure). SSLv3 and TLSv1.0 are very similar, but have a few differences. You could consider TLSv1.0 as SSLv3.1 (in fact that's what happens within the records exchanged). It's just easier to compare the TLSv1.0 with TLSv1.1 and TLSv1.2 because they've all been edited within IETF and ...


18

Have you tried syslog-ng and stunnel? Install Stunnel Create certificate files for syslog-ng over Stunnel Configure Stunnel for Use With syslog-ng Install syslog-ng Configure syslog-ng DONE! NOTE: Stunnel (http://www.stunnel.org) is a program that allows you to encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer) available on both Unix ...


15

I believe I've found myself an answer to this problem. After tinkering for a while, I decided to reproduce the problem in a clean installation. The ip_gre module is not inserted by default in the kernel after installing Debian. ip tunnel show does not display any tunnel. After inserting the ip_gre module, but without creating any tunnel, gre0 appears and ...


14

Give openvpn a shot. You can create tunnels over UDP or TCP.


13

Putty does support ssh tunnels, if you expand the Connection, SSH tree, you'll see an entry for tunnels. Local tunnels produce a localhost port opening on your windows machine that remotes to the ip address and port you specify. For instance, when I'm trying to RDP to a desktop at my house, I'll generally choose a random local port, something like 7789, ...


12

Short answer: VPN It may seem overkill, but it is the right answer and not that complicated to set up.


11

You can assign a name by using the fact your loopback adapter will basically respond to any address in the 127.0.0.0/8 network. So instead of binding to port 4321 you could bind to 127.1.2.3:4321. Then simply setup a host entry that map a name to the loopback address that you used so foo.bar maps to 127.1.2.3. In my SSH configuration on my admin ...


10

This will happen by default if the VPN is configured correctly. When you make a VPN connection from Windows CLIENT, there is an advanced option called Use Default Gateway on Remote Network which is checked by default. For example, in Windows XP: Go to Network Connections Right click on your VPN connectoid Choose Properties Go to the Networking Tab ...


9

I'm not sure what's causing your particular problem, but you should note that in general it's better for tunnels to use an unreliable transport stream (i.e. UDP) than a reliable one. The reason for this is that if you do happen to get packet loss the tunnelled TCP layer should be the one managing the retransmission, and not the real transport layer. If ...


9

If you are interested, I have a patch for keepalived which allows it to use unicast between a local and a remote VIP. I've successfully been using it at vps.net between virtual machines. It's a lot simpler than trying to set up a tunnel ! I've uploaded it there : http://1wt.eu/keepalived/ You then just have to specify "vrrp_unicast_bind " and "...


9

There is no need to use nginx. In your ssh daemon configuration (it should be /etc/ssh/sshd_config) set GatewayPorts to clientspecified and reload it. This is necessary for other systems to be able to connect to your tunnel. Without it, only programs running on your server will be able to use it. Now all you need to do is modify your ssh command to listen ...


8

Hurricane Electric has POPs all over Europe, and distributes free IPv6 tunnels. I have one in France (www.bortzmeyer.org) and I'm quite happy with their reliability.


8

This being a tunnel opened at a remote server, that server needs to have GatewayPorts set to yes in its /etc/ssh/sshd_config. Depending on what kind of users that server have you might want to use the Match option to limit that capability to your user. Match User middleuser GatewayPorts yes Do note that you probably want to add this Match block in the ...


8

There is an alternate if you want to use PuTTY for both hops. In this example we are hopping from Gateway #1 (10.0.1.123) to Gateway #2 (10.0.1.456) to port 80 on 10.0.1.789. First create hop to gateway #1. First setup the connection to the first server. Setup a tunnel to the second gateway in Connection>SSH>Tunnels. In this example we're forwarding ...


8

I have experienced similar issues. If you are tunneling with Firefox through ssh, some http connections can simply timeout due to server load or improper configuration. When the connection actually does timeout, you'll get an error message like the one you indicated. You can suppress these messages with the following command ssh user@xx.yy.zz.41 -p 1234 -D ...


7

Rsyslog can do this. Encrypting Syslog Traffic with TLS


7

For over a year i have been using m0n0wall for its IPv6 connectivity. It isn't perfect, as m0n0wall still has a lot of IPv6 functionality missing (e.g. traffic shaping). But it does have extraordinarily simple IPv6 Tunnel Broker setup. Now pfSense 2.1 has been released, with (hopefully) more IPv6 support than m0n0wall. On the other hand, the setup of an ...


7

Expanding on Zoredache's comment, the only way you're going to get any sort of space in a broker is to DIY it with a VPN/tunnel. A /25 is 128 IPv4 addresses which are a highly valued commodity these days that you are going to pay out the roof for.( Expect 1-2 dollars IP per month atleast) For a block that big you will need to fill out a justification for ...


7

What you describe is not possible. But there's still good news: What is possible however is to establis a Dynamic connection with the SSH Server. This will open a port on your local computer to which you can point the Proxy setting of your Browser and allow you to use the tunnel as a proxy server. But you have to type a hostname/ip and port into the browser ...


6

In your authorized_keys file you can specify which command will be run when they login. You could simply set that command to run something that will just wait around for a long time. The sshd man page as a list of all the options you can use in your authorized_keys file. permitopen="tsserver.example.org:3389",no-pty,no-agent-forwarding,no-X11-forwarding,...


6

SSH VPN tunnels still use the ssh connection, no? Last I checked it did. And since ssh runs over TCP that means that the VPN runs over TCP. This is not a good way to do it. A single dropped packet will cause i hickup of ALL communication that's going through the tunnel. Tunneling IP over TCP is a bad idea. OpenVPN can use TCP or UDP. UDP is preferred for ...


6

You're connecting to tcp my.server.com:5000, it runs ssh subsystem "app" there. What is being performed is defined by that subsystem (in the ssh server config file). That subsystems could transfer data forth and back, via stdin and stdout. External adversary sees tcp connection, sees that this is ssh session and nothing more. This is not called "ssh ...


5

Inside the sshd_config file just change the #PermitTunnel setting from no to yes. from #PermitTunnel no to PermitTunnel yes


5

I understood that you want just to log in to the computer C, not really tunnel anything from A to C. So, this should do the trick: ssh -t computer-b "ssh computer-c" You might have to enter passwords twice, first for computer B and then for computer C, but this can be avoided by using ssh's key-pair authentication.


5

You can do it with netcat, but it's a huge security hole: http://www.stearns.org/nc/ http://forums.remote-exploit.org/newbie-area/5857-netcat-port-redirection.html mknod backpipe p nc -l -p 80 0<backpipe | tee -a inflow | nc localhost 81 | tee -a outflow 1>backpipe FWIW, this is probably a profoundly bad idea.... make sure your firewall is tight ...


5

I think a bit of a diagram may be in order here. You say that you've already setup an SSH over HTTP tunnel through the proxy server. Assuming you're running something on the remote server computer to handle terminating that SSH over HTTP tunnel you should be in business. It sounds like you don't really have an SSH over HTTP proxy, if you're still trying to ...


5

To open a port 12345 on your local machine that, when connected to, will connect to a port 54321 on remotemachine (the machine you're SSH'd into): ssh -L 12345:localhost:54321 remotemachine


5

You should be able to tunnel the telnet session through SSH similar to the following. plink -pw mypswd -L 23:192.168.0.1:22 root@192.168.0.1 Then you can connect on localhost:23 and have this traffic tunneled through SSH to your server.


5

Create a Dynamic application-level port forwarding (socks proxy basically) with your SSH tunnel, and then point your applications through this one. To create a dynamic tunnel, connect as follows: ssh user@host.domain.com -D 127.0.0.1:31337 Then configure your application to use this as a SOCKSv5 proxy. If you want a hostname bound to this, just add /etc/...


5

See http://www.linuxfoundation.org/collaborate/workgroups/networking/tunneling#IPIP_tunnels and the paragraph below. Basically it's that IPIP can handle only IPv4 unicast, no multicast traffic and only one tunnel for unique tunnel endpoints pair. GRE is more generic, with up to 64k tunnels between two unique endpoints plus multicast traffic which is ...



Only top voted, non community-wiki answers of a minimum length are eligible