Using FTP client through VPS (double hop)

Question

Is it possible to log into a server using an FTP client (e.g. Cyberduck) through a VPS, i.e. doing a double-hop to access a server?

Here's what I'm trying to do: my home computer is a mac, and my normal S/FTP client is Cyberduck. I have an Ubuntu VPS through DigitalOcean. The server I wish to connect to only allows connections from the IP (IPv6) of my VPS. Therefore, I want to connect to the server using Cyberduck (or another GUI-based Mac FTP client) via the VPS. I have public keys set up to connect without passphrase to the VPS, and need to use a passphrase to connect to the server from the VPS.

Am I wanting to set up a tunnel? Or a proxy? Or what?

The answer provided at SFTP over double server hop only gives answers for command-line or Windows. I'm looking for a GUI solution on the Mac.

Answer 1

It sounds like you want to connect to your VPS using an SSH tunnel, and then from there, use cyberduck to connect to your other server via that tunnel.

EDIT: I have no idea if this will work for IPv6, but someone more knowledgable in that area should be able to help out.

So, GUI for mac for ssh tunnels: http://projects.tynsoe.org/en/stm/ SSH tunnel manager is a great little tool to save you using using the command line to setup the tunnel.

Here are the basics

Host: is the server you want to SSH to as your first hop. In this case your VPS. Port: this will be the standard SSH port (22)

Local Redirections: What this does is tunnels localhost ports (127.0.0.1:xxxxx) to a connection made by the Host to another computer and specific port.

Left port column: This is the localhost port your local app will connect to to get through the tunnel.

Remote host: this is the address of the computer you want the tunnel to connect to at the other end. ie. your end destination.

Right port column: This is the port you would connect to on the remote host, if you could connect directly. In your case the standard SSH port again.

You can see in the screenshot the command it runs in terminal on your behalf.

Close the preferences window, and then connect the tunnel.

The next step is configuring your FTP/SFTP client.

Set the host of Cyberduck to 127.0.0.1:222 (if you chose 222 in the left column like my screenshot example) Put in your authentication details, and hit connect.

Theoretically, the stars should align and you should be connected to your second server.

Answer 2

Based on what I understand from your need, I see 2 potential solutions:

1. Use de SOCKS server mode of ssh (the "-D " option) and set Cyberduck to open your ftp connection using this SOCKS server (server = localhost, port = the local port specified on the -D option of ssh)

2. Have a look and try "sshuttle", an open source program I recently heard of (but never tested)

Good luck ! And tell us if it worked for you.

Answer 3

As @Jakuje said in comments just put something like this:

Match group users
    ChrootDirectory %h
    X11Forwarding no
    AllowTCPForwarding no
    ForceCommand internal-sftp

at the end of /etc/ssh/sshd_config file in your Ubuntu VPS, which will allow all users in users group have sftp access to their home directory. then use your mac client (eg. cyberduck) to connect to this user with correct configuration. then you are done ;)

It is also possible to change group users to any group you want or just use Match user USERNAME to enable this feature for just one user.

Answer 4

In the end I used the instructions here: http://backdrift.org/transparent-proxy-with-ssh

I then used TextWrangler's "Open from SFTP Server" ability, and this worked. It appears as though the specific connection I was working on was somehow blocking cyberduck, but it allowed TextWrangler.