Is there a self-contained alternative to ssh -R [bind_address:]port:host:hostport functionality?

Basically, I have a machine that doesn't have a public IP address. I need to be able to SSH into said machine.

The easiest way to accomplish this would be through a reverse SSH connection — by doing ssh -R "8022:[::1]:22" guest@host in a loop on the machine without a public IP address; which would subsequently make it possible to ssh into said machine by using ssh root@host -p8022 from anywhere on the internet.

However, this setup requires adding a new user on host, which, if not done correctly, may involve a potential compromise or open a vulnerability, especially if you don't necessarily trust the machine that doesn't have a public IP. Additionally, it may also require administrator privileges on the machine with a public IP, as the sshd might be configured with the AllowTcpForwarding=no, as per sshd_config.

  • After you commented under my answer I'm almost voting to close the question as "unclear what you're asking". Are you a user who wants to forward ports without any support from the host administrator? Or are you the said administrator, afraid he's not competent enough to create a user account correctly? (this concern is a good thing). I thought you were the former. If the latter, maybe this will help: How to create a restricted SSH user for port forwarding?. Anyway, you should specify your role. – Kamil Maciorowski Jan 10 at 7:48
  • I just want a tool and/or scripts that's easy to deploy and doesn't require any big dependencies (and wouldn't leave me worried about adding a user incorrectly). – cnst Jan 10 at 8:31
  • Specifically, yes or no: (1) Do you have a user account on host? (2) Do you have root access on host? – Kamil Maciorowski Jan 10 at 8:40
  • @KamilMaciorowski (1), yes, of course; (2), n/a — whether or not you have root access on host is irrelevant to the question; the main part is that you do have permissions to accomplish the requirements, and, as pointed out in sshd manual page, it should really be a rather trivial task to start with. – cnst Jan 10 at 23:13
  • OK. Now I think I get it. Note you didn't say "this setup requires adding a new user if you don't necessarily trust the machine" which makes a lot of sense when you already have a user account. You said "this setup requires adding a new user […] which […] may […] open a vulnerability, especially if you don't necessarily trust the machine". As if the method required adding a new user. Period. (And if you don't trust, then it most likely opens a vulnerability). That's why I thought you had no user account yet and you'd like to trigger port forwarding on host with no account nor admin support. – Kamil Maciorowski Jan 11 at 1:11

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.