I am using a linux server on the net and reverse port forwarding to connect to machines behind firewalls.

  • From Remote I reverse forward Port 22 to some_port on Middle
  • From Home I ssh into user@Middle on port some_port

Lets say I am careful to compare host keys and fingerprints of Remote and Home.

  1. Can an attacker on Middle see my unencrypted traffic? (Well I guess that would be a no)
  2. Can an attacker on Middle Fake the whole thing somehow and let me reveal my secrets? (keys, passphrase, stuff like that)
  3. What it boils down to: How vulnerable is that setup?

Intuitively I would say, that there's not much they can do, since Middle does not see any unencrypted traffic, but I am still not entirely sure.


Once the tunnel is setup, a Man-in-the-Middle attack on the data path is as difficult as breaking into the encryption -- so, you are covered there.

However, the concern about MitM during connection setup (imo) may have some weight.
To cover that, I think you should use authorized keys always (for both connection setups).

These are things you will need to confirm.

  1. Remote to Middle tunnel is safely established on some well-known-port 'P' of Middle
    using authorized key of Remote.
  2. Home to Middle connect is established on that port 'P' using authorized key of Home
    (which I expect is placed in the authorized_keys file at Remote).

When these two are confirmed, you will not complete a Home to Remote connection over this tunnel unless Remote can validate Home key.

This requires that even if the Middle is compromised, the Remote is never compromised.
(ps: I think I need some more thought on this -- am open to comments and will correct or roll-back answer as fit)

  • yeah. My head hurts, too... these tunnel, reverse tunnel and auth things are never crystal clear to me. – AndreasT Jun 5 '11 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.