1

I feel like I may be using the wrong terminology in my research to-date, which is why I'm not finding what I'm looking for. All I've find is information on how to set up a Reverse SSH tunnel and/or how to SSH to the remote server from the server on the other end of the tunnel, but that's not what I'm looking for.

I have a number of remote servers that establish a Reverse SSH tunnel to a central server (I call this the "jump server", but I've also seen it referred to as "bastion server" and other terms). These Reverse SSH tunnels work fine and from the "jump server" itself, it's possible to SSH to any of the remote servers by simply SSH'ing to the port number of the particular server's tunnel (using the -p flag).

But what I'm trying to do is SSH from a server other than the "jump server" (potentially even using something like PuTTY), through the "jump server", and then to the remote server. I'm pretty sure this is possible, but I'm not having any luck with the syntax of that command (or any of the "tunneling" features of PuTTY).

The "jump server" is running Ubuntu 18.04. I've tried SSH'ing from other Ubuntu servers and from a Windows server using PuTTY, but my first objective is to get this working between two Linux servers first (PuTTY is a bonus).

The Reverse SSH tunnels are set up from the remote servers, to the "jump server", using this command on the remote servers:

ssh -i /home/root/.ssh/rssh_rsa -f -K 10 -N -R 0:localhost:22 jump.example.com

(Note that the 0 before localhost causes the "jump server" to choose the port number for its end of the tunnel dynamically).

2

I think all you need to do is add *: at the beginning of the tunnel endpoint spec. So you'd have *:0:localhost:22. This tells ssh to listen on all interfaces, rather than just localhost, on the jumphost tunnel endpoint.

If the jumphost has multiple interfaces, you can specify one of them to listen on (e.g., 192.168.1.1:0:localhost:22).

You'll then just want to ssh -p NNN jump.example.com to get into the tunnel.

Hopefully this is obvious, but this will mean that anyone who can connect to that port on the jumphost can then connect to the remote server. Set your firewall rules accordingly.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.