Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I usually provide solutions for my friends for fixing issues on their ubuntu machines. Most of them use shared internet connection over LAN where they cannot open ports for allowing me access their machines over ssh. Is it possible to ssh into a machine without opening ports. For example services like Teamviewer allow users to just accept a connection request from outside, and if the owner of the machine permits, then the machine can be used by authenticated users. So, similarly, if the owner of the machine permits, with some kind of authentication, one should be able to get ssh access to a machine without opening the ports on the NAT router.

share|improve this question
add comment

4 Answers 4

up vote 5 down vote accepted

You can do this over Empathy's backend (telepathy) through another application called ssh-contact.

I haven't used it personally, but it seems to me like a good way of getting two novices to SSH into each other.


Of course another method would be to have them SSH to you (I assume you're competent enough to manage your port forwarding) and forward a port back to a ssh server on their machine.

Get them to run:

ssh -R 48724:localhost:22 your_username@your_ip

You obviously might not want them logging in as your user so you could create another user and have that just for SSHing. There obviously has to be a modicum of trust between you and the other user.

And then you run:

ssh -p 48724 their_username@localhost

I'm using a high port so root privileges aren't required.

Of course, they'll need openssh-server installed for you to connect but that's a simple sudo apt-get install openssh-server

share|improve this answer
    
If I go by your second suggestion, should I only open port 22 on my NAT router? –  nixnotwin Dec 2 '10 at 1:02
    
Yeah. On a side note, I actually use a high port (in the 4xxxx-5xxxx range) so that people can't guess it (helps stop brute attacks) and forward to that port. For that you need to change your local /etc/ssh/sshd_config and also add -p 4xxxx to the connection string you give to the other user. –  Oli Dec 2 '10 at 9:41
    
add comment

Perhaps this article about reverse SSH tunnel could be of some help to you:

http://www.marksanborn.net/howto/bypass-firewall-and-nat-with-reverse-ssh-tunnel/

share|improve this answer
add comment

Any incoming connection by any means whatsoever will require opening a port. There's just no other way to make a network connection. If there is no existing port you can use, then you can't simply go that direction.

But you can go the other way. If you have your friend open an ssh connection to your machine, and port forward the ssh port, then you can ssh back through his tunnel to his machine. This gives you an ssh connection to his machine that will only survive as long as his ssh to you, (complete with port forwarding), remains.

This method also ducks firewalls.

share|improve this answer
add comment

With straight-up ssh this is not possible. However, there is likely some other tool that would accomplish what you are trying to do.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.