0

Suppose, I've got a computer in my home network running Ubuntu and Glassfish Application Server. I'm debugging my web application on it using WiFi. Next step would be uploading some sensitive data. I'm worrying about security of the WiFi. I don't want to overcomplicate this setup nor lose comfort of my WiFi. So, I've decided to bind Glassfish's listener to ::1 and forward server's port 8080 to my laptop using ssh tunnel.

wget localhost:8080/ is working as expected, downloading root index.html

Remote access to port 8080 of my server isn't working - as expected.

ssh -L 8080:homeserver:8080 minorthreat@homeserver - channel 2: open failed: connect failed: Connection refused

doesn't work. I don't know why.

UPD:

  • I get the ssh connection to the remote server, so the credentials are ok, I suppose. I don't see a reason to put -vvv listing, but i'm including this anyway just for a case.

  • I've noticed that ssh can't register known_hosts for some reason, but it's a different problem with lower priority. I'll make it work using cert-based auth in near future

  • This tunnel worked when glassfish's listener was bound to 0.0.0.0. Alas, it's not ok, I want to forbid any connection to the server except those coming from ssh tunnel (mine connections from laptop).

  • The problem is that It doesn't forward connection laptop[localhost interface]:8080->homeserver[::1 interface]:8080

    OpenSSH_5.4p1, OpenSSL 1.0.0 29 Mar 2010
    debug1: Reading configuration data /etc/ssh/ssh_config
    debug2: ssh_connect: needpriv 0
    debug1: Connecting to homeserver [192.168.1.101] port 22.
    debug1: Connection established.
    Could not create directory '/home/mt/.ssh'.
    debug1: identity file /home/mt/.ssh/id_rsa type -1
    debug1: identity file /home/mt/.ssh/id_rsa-cert type -1
    debug1: identity file /home/mt/.ssh/id_dsa type -1
    debug1: identity file /home/mt/.ssh/id_dsa-cert type -1
    debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.2
    debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 pat OpenSSH*
    debug1: Enabling compatibility mode for protocol 2.0
    debug1: Local version string SSH-2.0-OpenSSH_5.4
    debug2: fd 3 setting O_NONBLOCK
    debug1: SSH2_MSG_KEXINIT sent
    debug1: SSH2_MSG_KEXINIT received                                                                                                                                                                                                               
    /..... skip encryption details to fit char limits ........./
    debug2: kex_parse_kexinit: none,zlib@openssh.com
    debug2: kex_parse_kexinit: none,zlib@openssh.com
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit: first_kex_follows 0
    debug2: kex_parse_kexinit: reserved 0
    debug2: mac_setup: found hmac-sha1
    debug1: kex: server->client aes128-ctr hmac-sha1 none
    debug2: mac_setup: found hmac-sha1
    debug1: kex: client->server aes128-ctr hmac-sha1 none
    debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<2048<8192) sent
    debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
    debug2: dh_gen_key: priv key bits set: 181/320
    debug2: bits set: 1066/2048
    debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
    debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
    debug3: check_host_in_hostfile: host homeserver filename /home/mt/.ssh/known_hosts
    debug3: check_host_in_hostfile: host homeserver filename /home/mt/.ssh/known_hosts
    debug3: check_host_in_hostfile: host homeserver filename /etc/ssh/ssh_known_hosts
    debug3: check_host_in_hostfile: host homeserver filename /etc/ssh/ssh_known_hosts
    debug3: check_host_in_hostfile: host 192.168.1.101 filename /home/mt/.ssh/known_hosts
    debug3: check_host_in_hostfile: host 192.168.1.101 filename /home/mt/.ssh/known_hosts
    debug3: check_host_in_hostfile: host 192.168.1.101 filename /etc/ssh/ssh_known_hosts
    debug3: check_host_in_hostfile: host 192.168.1.101 filename /etc/ssh/ssh_known_hosts
    debug3: check_host_in_hostfile: host homeserver filename /home/mt/.ssh/known_hosts
    debug3: check_host_in_hostfile: host homeserver filename /etc/ssh/ssh_known_hosts
    debug2: no key of type 0 for host homeserver
    debug3: check_host_in_hostfile: host homeserver filename /home/mt/.ssh/known_hosts2
    debug3: check_host_in_hostfile: host homeserver filename /etc/ssh/ssh_known_hosts2
    debug3: check_host_in_hostfile: host homeserver filename /home/mt/.ssh/known_hosts
    debug3: check_host_in_hostfile: host homeserver filename /etc/ssh/ssh_known_hosts
    debug2: no key of type 2 for host homeserver
    The authenticity of host 'homeserver (192.168.1.101)' can't be established.                                                                                                                                                                      
    RSA key fingerprint is 45:84:58:01:80:95:bb:71:0e:a3:66:2f:e6:cd:e9:34.
    Are you sure you want to continue connecting (yes/no)? yes
    Failed to add the host to the list of known hosts (/home/mt/.ssh/known_hosts).
    debug2: bits set: 1010/2048
    debug1: ssh_rsa_verify: signature correct
    debug2: kex_derive_keys
    debug2: set_newkeys: mode 1
    debug1: SSH2_MSG_NEWKEYS sent
    debug1: expecting SSH2_MSG_NEWKEYS
    debug2: set_newkeys: mode 0
    debug1: SSH2_MSG_NEWKEYS received
    debug1: Roaming not allowed by server
    debug1: SSH2_MSG_SERVICE_REQUEST sent
    debug2: service_accept: ssh-userauth
    debug1: SSH2_MSG_SERVICE_ACCEPT received
    debug2: key: /home/mt/.ssh/id_rsa (0x0)
    debug2: key: /home/mt/.ssh/id_dsa (0x0)
    debug1: Authentications that can continue: publickey,password
    debug3: start over, passed a different list publickey,password
    debug3: preferred publickey,keyboard-interactive,password
    debug3: authmethod_lookup publickey
    debug3: remaining preferred: keyboard-interactive,password
    debug3: authmethod_is_enabled publickey
    debug1: Next authentication method: publickey
    debug1: Trying private key: /home/mt/.ssh/id_rsa
    debug3: no such identity: /home/mt/.ssh/id_rsa
    debug1: Trying private key: /home/mt/.ssh/id_dsa
    debug3: no such identity: /home/mt/.ssh/id_dsa
    debug2: we did not send a packet, disable method
    debug3: authmethod_lookup password
    debug3: remaining preferred: ,password
    debug3: authmethod_is_enabled password
    debug1: Next authentication method: password
    minorthreat@homeserver's password:                                                                                                                                                                                                                   
    debug3: packet_send2: adding 48 (len 63 padlen 17 extra_pad 64)
    debug2: we sent a password packet, wait for reply
    debug1: Authentication succeeded (password).
    debug1: Local connections to localhost:8080 forwarded to remote address homeserver:8080
    debug3: channel_setup_fwd_listener: type 2 wildcard 0 addr NULL
    debug1: Local forwarding listening on 127.0.0.1 port 8080.
    debug2: fd 4 setting O_NONBLOCK
    debug3: fd 4 is O_NONBLOCK
    debug1: channel 0: new [port listener]
    debug1: channel 1: new [client-session]
    debug3: ssh_session2_open: channel_new: 1
    debug2: channel 1: send open
    debug1: Requesting no-more-sessions@openssh.com
    debug1: Entering interactive session.
    debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
    debug2: callback start
    debug2: client_session2_setup: id 1
    debug2: channel 1: request pty-req confirm 1
    debug2: channel 1: request shell confirm 1
    debug2: fd 3 setting TCP_NODELAY
    debug2: callback done
    debug2: channel 1: open confirm rwindow 0 rmax 32768
    debug2: channel_input_status_confirm: type 99 id 1
    debug2: PTY allocation request accepted on channel 1
    debug2: channel 1: rcvd adjust 2097152
    debug2: channel_input_status_confirm: type 99 id 1
    debug2: shell request accepted on channel 1
    Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-91-generic x86_64)
    
  • Can you post the output of ssh -vvv minorthreat@homeserver – Panther Aug 15 '17 at 20:03
  • Updated post for you – Minor Threat Aug 15 '17 at 20:31
  • Try ssh -f minorthreat@homeserver -L 8080:homeserver:8080 -N -f tells ssh to run in background and -N not to run any commands remote. – Panther Aug 15 '17 at 20:45
1

Your problem is that you're telling SSH to connect to (forward connections to) homeserver:8080 on the remote end, but your glassfish isn't bound to that IP; it's bound to localhost.

Try ssh -L 8080:localhost:8080 minorthreat@homeserver.

  • However, I've decided to spend some time tuning up openvpn server and binding all java and postgres endpoints to the tap0 interface. Much more convenient this way. Thanks, anyway. – Minor Threat Aug 17 '17 at 2:34
  • Be aware, though, that this makes them addressable on the local network(s) your server is on. E.g. if your tap0 has 192.168.42.42/24, and your eth0 interface has 10.1.1.1/24, then someone on the 10.1.1.0/24 network who knows about your 192.168.42.42 address can send packets from e.g. 10.1.1.2, addressed to 192.168.42.42 in the IP layer and to your eth0's MAC address, and your Linux box will receive them and reply to them. This doesn't need any complicated coding on the client; they just need to add a route via 10.1.1.1 towards 192.168.42.42. – András Korn Aug 18 '17 at 6:52
  • So, binding services to a tap0 interface doesn't "hide" them as thoroughly as binding them to a loopback address. – András Korn Aug 18 '17 at 6:54
  • How could this be? I haven't configured my Linux as a router. Why should it forward packets from one interface to another? – Minor Threat Aug 18 '17 at 11:55
  • $ cat /proc/sys/net/ipv4/ip_forward 0 – Minor Threat Aug 18 '17 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.