<div dir="rtl"><div dir="ltr">If you just want an ssh connection you can simply redirect connection attempts to some port on the<br></div><div dir="ltr">Internet-accessible machine to port 22 on the private-ip one - using whatever tool that fits you best -</div>
<div dir="ltr">iptables, xinetd, redir, probably many others.</div><div dir="ltr">-- </div><div dir="ltr">Didi</div><div class="gmail_extra"><br><br><div class="gmail_quote"><div dir="ltr">2014-07-20 13:31 GMT+03:00 Erez D <span dir="ltr"><<a href="mailto:erez0001@gmail.com" target="_blank">erez0001@gmail.com</a>></span>:</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">looks a little complicated - extra ssh server, firewall with port knocking<br>
all this for a ssh connection ...<br>
<div class="HOEnZb"><div class="h5"><br>
On Sun, Jul 20, 2014 at 11:38 AM, Rabin Yasharzadehe <<a href="mailto:rabin@rabin.io">rabin@rabin.io</a>> wrote:<br>
> you can add a port-knocking tool like fwknop to add a dynamic rule to<br>
> forward your connection into the privet machine.<br>
><br>
> --<br>
> Rabin<br>
><br>
><br>
> On Sun, Jul 20, 2014 at 12:16 PM, Erez D <<a href="mailto:erez0001@gmail.com">erez0001@gmail.com</a>> wrote:<br>
>><br>
>> On Sun, Jul 20, 2014 at 11:06 AM, Lior Kaplan <<a href="mailto:kaplanlior@gmail.com">kaplanlior@gmail.com</a>><br>
>> wrote:<br>
>> > Didn't check it, but login in with a user who has /bin/true might do the<br>
>> > trick.<br>
>> you are correct, it works.<br>
>> however it is still a security risk, as this means the client may<br>
>> listen on unused port ...<br>
>><br>
>> ><br>
>> > Kaplan<br>
>> ><br>
>> ><br>
>> > On Sun, Jul 20, 2014 at 12:03 PM, Erez D <<a href="mailto:erez0001@gmail.com">erez0001@gmail.com</a>> wrote:<br>
>> >><br>
>> >> On Sun, Jul 20, 2014 at 10:39 AM, Lior Kaplan <<a href="mailto:kaplanlior@gmail.com">kaplanlior@gmail.com</a>><br>
>> >> wrote:<br>
>> >> > ssh itself ?<br>
>> >> ><br>
>> >> > <a href="http://www.thegeekstuff.com/2013/11/reverse-ssh-tunnel/" target="_blank">http://www.thegeekstuff.com/2013/11/reverse-ssh-tunnel/</a><br>
>> >> nice, however this requires me to give access to my server, which i do<br>
>> >> not want ...<br>
>> >> (or, can i give people permission to ssh to my server only for reverse<br>
>> >> tunnels and no shell ?)<br>
>> >><br>
>> >> ><br>
>> >> > Kaplan<br>
>> >> ><br>
>> >> ><br>
>> >> > On Sun, Jul 20, 2014 at 11:36 AM, Erez D <<a href="mailto:erez0001@gmail.com">erez0001@gmail.com</a>> wrote:<br>
>> >> >><br>
>> >> >> hello<br>
>> >> >><br>
>> >> >> i have a linux machine with a private ip connected to the internet<br>
>> >> >> i have a public ip and need to ssh to the linux box<br>
>> >> >><br>
>> >> >> any tools for that ?<br>
>> >> >><br>
>> >> >> _______________________________________________<br>
>> >> >> Linux-il mailing list<br>
>> >> >> <a href="mailto:Linux-il@cs.huji.ac.il">Linux-il@cs.huji.ac.il</a><br>
>> >> >> <a href="http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il" target="_blank">http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il</a><br>
>> >> ><br>
>> >> ><br>
>> ><br>
>> ><br>
>><br>
>> _______________________________________________<br>
>> Linux-il mailing list<br>
>> <a href="mailto:Linux-il@cs.huji.ac.il">Linux-il@cs.huji.ac.il</a><br>
>> <a href="http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il" target="_blank">http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il</a><br>
><br>
><br>
<br>
_______________________________________________<br>
Linux-il mailing list<br>
<a href="mailto:Linux-il@cs.huji.ac.il">Linux-il@cs.huji.ac.il</a><br>
<a href="http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il" target="_blank">http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il</a><br>
</div></div></blockquote></div><br></div></div>