1

I've been accessing a server's files via Sublime SFTP.

The issue is that I need to tunnel into my destination server via a middle-man server (that I have root access to).

Client → Server A (middle-man node) → Server B (destination node)

Normally I'd use a tunneling option in the client software, but in this case Sublime doesn't seem to have that feature.

What's the best way for me to configure the middle-man server (apache) to accomplish this? (or something like it)

For example, maybe there's a way to automatically have Server A connect to Server B when the client successfully connects to a particular port?

Improve this question
3
  • Is Apache the only service at your disposal on the middle server? If so, you're out of luck.
    – EEAA
    Apr 24, 2017 at 23:13
  • No I can use other services typically found on linux machines or even configure a new one.
    – Orun
    Apr 24, 2017 at 23:36
  • Yes you can forward sftp connections with any TCP transparent solution (including Kernel DNAT rules). A generic TCP proxy, HAProxy or even ssh server side forwards. For ftp/s it could be a bit more tricky because of the data connection.
    – eckes
    Apr 25, 2017 at 11:19

3 Answers 3

Reset to default
4

With HAProxy you can create a TCP proxy to proxy the connection back to the backend server. I do this frequently.

Improve this answer
3
  • Not sure why you were downvoted. I do this as well for ssh/sftp all the time and it's perfect. No extra buffer limits from yet another ssh session. It damonizes perfectly in user space, takes trivial amounts of memory and is rock solid. This wont work for standard ftp however. haproxy can also use acl's for access control.
    – Aaron
    Apr 25, 2017 at 1:36
  • Thanks, I configured HAProxy just now. Is the solution you're describing a transparent proxy? As described here or something else?
    – Orun
    Apr 26, 2017 at 16:08
  • 1
    No, you would configure HAProxy as if you were going to do TCP load balancing, although you would specify only one server as the backend. coolaj86.com/articles/… (not my blog) you can bind the frontend to port 2222, then have it redirect to server B on port 22. When you hit server A on port 2222, it should connect you through.
    – Linuxx
    Apr 26, 2017 at 23:35
1

I would recommend that you use SSH Tunneling. 

ssh -L 9999:server_b:22 username@server_a

You'll of course also need to confirm that Server A's firewall accepts inbound TCP connections on your port of choice.

Improve this answer
2
  • Can't use ssh -L unfortunately as my client (Sublime Text) doesn't allow ssh with flags
    – Orun
    Apr 27, 2017 at 20:44
  • You don't necessarily need to initiate the tunnel from Sublime, you just need the port available to it. I would recommend that you create the tunnel with a standalone ssh client of your choice, and then utilize the port that it has opened for you.
    – billkw
    May 1, 2017 at 3:26
1

You could use rinetd to acomplish what you want:

apt install rinetd

Then you edit /etc/rinetd.conf, and add your configuration at the end:

SERVER_A_IP SERVER_A_PORT SERVER_B_IP SERVER_B_PORT

Example:

# Server A IP: 192.168.0.1
# Server B IP: 1.2.3.4
# Listen on port 8080 on local server and redirect to 22 on remote server
# Configuration
192.168.0.1 8080 1.2.3.4 22

Finally you restart the service:

systemctl restart rinetd

And connect through SERVER A:

sftp -P 8080  user@SERVER_A_IP
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .