Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Consider ssh -R '0.0.0.0:9090:localhost:5050' restricted@myvps.example.com

  • A laptop is running a webserver on port 5050
  • The laptop is behind a router with NAT and port forwarding cannot be configured
  • A VPS is sitting out on the internet as myvps.example.com
  • restricted has /bin/rbash as the shell with PATH="" (no execution possible)
  • When a user visits http://myvps.example.com:9090 they can interact with the webserver on the laptop's localhost:5050 (although the Host: header is incorrect)

The remaining problem is that the untrusted laptop could remote forward port 9091, which is reserved for another computer's use.

My goal is to create a system that can allow multiple untrusted computers behind NATs to have 2 ports (each) forwarded from a public VPS to their localhost.

Using ssh isn't required, but it provides both a method for identification and port forwarding, which are required.

It would be simpler to restrict ports on a per-key (or per-user) basis, especially since more than one machine behind a single NAT may use the system (and hence IP addresses aren't reliable for identification).

After more searching it seems that this isn't possible yet: https://bugzilla.mindrot.org/show_bug.cgi?id=2038

I wonder if there's another solution that could work for the use case...

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.