jaygoldberg / rstunnel Goto Github PK

View Code? Open in Web Editor NEW

27.0 3.0 8.0 55 KB

A continuation of Reliable SSH Tunnel, to set up and maintain persistent SSH (reverse) tunnels like autossh

License: MIT License

Shell 100.00%

shell ssh sysadmin-tool

rstunnel's Introduction

RSTunnel

A continuation of Reliable SSH Tunnel, without needing the autossh binary.

RSTunnel (Reliable SSH Tunnel) is a set of pure shell scripts (/bin/sh compatible) that maintain a secure tunnel from a client to a server.

Why would you need a reverse tunnel?

RSTunnel is useful for situations where you want to have SSH access to administer remote endpoints that are behind NAT. For example, if you deploy IP cameras or WiFi Access Points to customer premises and need the ability to connect back to them through an intermediate host without setting up port forwarding rules at your client site (or you do not have admin access to the firewall to do so).

Why a new project?

autossh will probably meet your needs just fine. However, it requires you to compile a binary for non-standard platforms (ARM, MIPS), on things like WiFi access points, IP cameras, etc. Getting a cross-compiling toolchain is non-trivial. Better to depend on built-in binaries.

The goal of this continuation of RSTunnel is to require nothing more than a shell, even a simplistic one like ash, and also, compatibility with the dropbear SSH client.

Usage

$ ./rstunnel --help
Usage: rstunnel [OPTION]
RSTunnel (Reliable SSH Tunnel) maintains a secure tunnel between two
hosts. By default, will start the tunnel and fork into the background.
can also start from cron, or in foreground daemon mode (and
also from cron)

  -e, --email     Turn on the e-mail feature. If the tunnel goes down, an e-mail
                  will be sent to the address figured. Be sure to add the template
                  file 'mail.message' exists in the directory where rstunnel resides
                  . This is the source of the mail message. Useful when rstunnel is
                  running from a cron job or in the background using '-d' option
  -v, -vv, --verbose
                  '-v' is VERBOSE output, ' is VERBOSE output, '-vv' is DEBUG
                  output. It is not reccomended that you run in DEBUG mode when
                  running in cron as there is quite a lot of output
  -s, --status    List active tunnels matching config
  -k, --kill      Kill an existing tunnel(s) matching config
  -d, --daemon    Daemonize, run in a constant watch loop in foreground
  -?, -h, --help  This help message

FAQ

`Exited: String too long`

>> Attempting to start tunnel

/usr/bin/ssh: Exited: String too long
running tunnel: 1, exiting!

This is because the provided private SSH key is likely in openssh format and needs to be converted to PEM, then dropbear format using dropbearconvert.

$ ssh-keygen -m PEM -p -f /root/.ssh/id_rsa > /root/.ssh/id_rsa_pem
$ dropbearconvert openssh dropbear /root/.ssh/id_rsa_pem /root/.ssh/id_rsa_dropbear
Key is a ssh-rsa key
Wrote key to '/root/.ssh/id_rsa_dropbear'

rstunnel's People

Contributors

Stargazers

Watchers

Forkers

borgified jn7163 stinby johnsonhit iamdevnull ortizvinicius rrakso gl-yziquel

rstunnel's Issues

Log management

Manage log file based on size and/or date, prune the old stuff.

`$SSHPATH` is not used in the function to check if binaries are available

for cmd in ssh nc; do
    if [ ! $(which $cmd) ]; then
      ErrMsg "[FATAL] Can't find $cmd, make sure the required binaries \
      are installed and that their paths in the config are correct"
      exit 1
    fi
  done

In this code we do not take into account the rstunnel.conf overrides for binary locations, instead relying on $PATH.

Put daemon functionality into main script

put most everything into main() and call that from a loop with the -d command flag

Reverse dynamic port assignment

Use HTTP GET to get the reverse port we should assign on the remote end, in case we want the conducting server to orchestrate port assignments from multiple reverse SSH clients.

Format of file on server:

host=clientname,48859

Where the second number is the port that the client should assign as a remote port connecting to local SSH port (probably 22).

Implement HTTP calls as alternate method to mailing

email through raw SMTP is getting more difficult these days due to mail filtering, SMTP restrictions, and required SSL transports. Some embedded platforms don't have the mail command at all. Implement a way to invoke an HTTP GETs to a specified URL/IP using netcat or similar.

This would also have the nice side effect of revealing the IP that the RSTunnel host is at, in case that helps.

add kill option (-k)

Manually killing the tunnel with ps then kill is kinda inconvenient. Add a flag to support doing this.

If `dropbearmulti` is copied to `ssh` (since FAT32 doesn't support symlinks, like on an SD card) then determining if we are using Dropbear fails

if [ "$(IsLinked ssh dropbearmulti)" == 'true' ] || [ "$(IsLinked ssh dropbear)" == 'true' ]; then... doesn't work

support reverse tunnels

specify local ssh port, remote forwarded port

Check if port forwards are established otherwise restart tunnel

Ran into an instance where the tunnels were open, but the reverse ports were not assigned on the remote host. Likely because they were already assigned at the instantiation of the tunnel (again). Normally in interactive you'd see "could not set up port forwarding" or similar. We should either check for that, or possibly increase the sleep before a tunnel is brought back up to allow the remote end to close the port.

When tunnel is already running, make sure we are verifying that data can be sent through forwarded ports.

Support `dropbear`

Dropbear:

doesn't have .ssh/config support
uses a non-standard binary key format
has slightly different commandline options
may have a different executable name(?)

At least provide hints on the key format thing.

nc on busybox still causes problems

We want to set NCFLAGS="-w 5 -q 1 -i 1" on busybox, but OpenWRT has:

root@OpenWrt:/overlay/RSTunnel# nc --help
BusyBox v1.24.2 () multi-call binary.

Usage: nc [IPADDR PORT]

Open a pipe to IP:PORT

Remove bashism(s) to finally rely only on simple `ash` and `sh`

Remove bashism

./rstunnel: 254: [: unexpected operator some of the paths do not exist ./rstunnel: 266: [: unexpected operator some of the paths do not exist ./rstunnel: 266: [: unexpected operator ./rstunnel: 281: [: Linux: unexpected operator ./rstunnel: 281: [: Linux: unexpected operator ./rstunnel: 285: [: Linux: unexpected operator [FATAL] Sorry, your OS is not supported.

Alternate host support

Allow user to specify several servers to connect to, including IPs as sometimes DNS may be failing or the main host may be down. Have some retry logic.

bad interpreter

Here is a bug:

https://github.com/JayGoldberg/RSTunnel/blob/master/install.sh

-bash: ./install.sh: /bin/ash: bad interpreter: No such file or directory