0

I want the avoid direct access to system A. However, there is a service C running on system A.

There is an other system B which could be accessed by anyone.

I would like to "forward" requests from B to A in way the user could think service C is running on B.

Technically I know how to implement two network programs (D and E) to achieve this requirement. D is running on system A connecting to E which is running on system B.

Any request to B for service C will be forwarded from E to D. D passed the request to the "real" service C. And the response in reverse order, of course.

Network Access Anyone -> B <- A
Programs  E <- D 

Service flow Anyone -> E -> D -> C 

For the one who are still with me:

Will I reinvent the wheel when doing such programs?

in other word, is there already a open source / linux program doing this feature?

1
  • 1
    investigate ssh tunnelling...
    – artbristol
    Feb 10, 2013 at 21:36

1 Answer 1

2

This looks like a textbook use case for SSH tunnelling.

On server A, install an SSH server (e.g. install the package openssh-server if it's Debian). On server B, run this command:

ssh -f SERVICEUSER@AHOST -L BPORT:AHOST:APORT -N

where SERVICEUSER is the name of user the service runs as, A is the hostname or IP of A, BPORT is the number of the port at which the service should be available on the server B, and APORT is the port at which the service is listening on server A. Here's more information: http://www.revsys.com/writings/quicktips/ssh-tunnel.html

You will have to run this command after each reboot, so it's best to write an init script for it so that it can be managed like a service. Start here: http://www.thegeekstuff.com/2012/03/lsbinit-script/

To avoid having to input SERVICEUSER's password, which is impossible in an init script, you'll also need to generate a private SSH key on the server B and add it to SERVICEUSER's authorized_keys file, which might involve creating a home directory for SERVICEUSER. Use the usermod -d command to do it: http://linux.die.net/man/8/usermod then follow http://www.eng.cam.ac.uk/help/jpmg/ssh/authorized_keys_howto.html One common pitfall to remember is that the authorized_keys file and the .ssh directory both have to be chmoded to 600 and owned by SERVICEUSER, otherwise the SSH server will ignore them.

2
  • Do I understand right, this solution requires access from server B to server A? Feb 11, 2013 at 12:54
  • It requires access from server B to the SSH service on server A (normally port 22, but you can configure it). No other remote access to A is required - you can configure the firewall on A to only accept connections to port 22 coming from B and reject all others. The connection between A and B will be encrypted. Feb 11, 2013 at 19:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.