I Want to Create a Secure Chat connection and tunnel through Ubuntu terminal or something like netcat (nc -l 1234) but netcat is not encrypted.


You could tunnel the traffic over SSH:

  1. On host1

    $ nc -l 1234
  2. On host2

    $ ssh host1 -L 1234:localhost:1234
    $ nc localhost 1234

The ssh command forwards all TCP connections from host2 port 1234 to the same port on host1.

| improve this answer | |
  • do i need port forwarding/nat/port mapping on modem for this? – bx758 Jun 7 '14 at 6:06
  • 1
    @bx758: This example only requires that you can create an SSH connection from host2 to host1. So host2 must be able to send packets to the IP address of host1 and port 22 (SSH) needs to open on host1. – Eero Aaltonen Jun 9 '14 at 12:55

Note for below you'll have to apply some special sauce of your own but if you check the build logs of a project I'm working on for GnuPG encryption and more specificly the scenario for sshfs you may find the features you seek.

Eero Aaltonen's answer is still totally valid and likely better for simple one off connections. But if ya want something with GnuPG then the above project exposes the encryption interfaces required to make that happen, mostly.

To better guide you if you wish to use the above project, here's some tips on modding the linked scenario for multi-recipient chat like behavior.

The Var_gpg_recipient_options variable should be appended with additional recipients as show below

Paranoid_Pipes.sh Var_gpg_recipient_options="${Var_gpg_recipient_options} --recipient second-user@host.domain" --help

Adjust other options and remove --help and that covers getting things encrypted, serving the output file to multiple clients can't be done with netcat but php has a way to serve it

php -S <Local_IP>:8080 -t /var/enc/chat

And while there's lots of ways to serve updated posts to a file the Google Code hosted PHP-tail source code looks like a promising place to start on serving the last few messages to clients for them to pull and decrypt locally.

Last is setting up client connections that decrypt, there's a helper script that has been written for bulk decryption already provided. Clients need to set up a connection like below to dump served encrypted data to am accessible location (for now, but work is being done on decryption from named pipes soon ;-)) hint you'll want to know about /dev/tcp/host/port (/dev/tcp/<serving_IP>/8080) paths that can be used like file descriptors... like I said there is a bit of special sauce required. But it's very close to being a full solution with above and some ingenuity you could have private chats that are secured with GnuPG hybrid encryption and only accessible to those that have required private keys.

Note the above is highly experimental and should not be used with primary key pares so look up the helper script for generating new testing key pares quickly.


While the above may still work, version two will likely need significantly less special sauce because pipe to pipe and other features have been solved, check the build logs mentioned earlier to see it in action.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.