Hacker News new | ask | show | jobs
Show HN: Mole – an open source tool to easily create ssh tunnels (davrodpin.github.io)
142 points by davrodpin 2808 days ago
15 comments

I'm not sure if I missed something? Normally I use -L syntax for tunneling (-L local_port:remote_addr:remote_port). Does this tool do more?
I don't think i've missed anything, it does the same thing as ssh -L with slightly different syntax.

It's the same with mosh. Normally i use tmux on the destination host, and i simply cannot see any reason to use mosh over ssh/tmux.

> i simply cannot see any reason to use mosh over ssh/tmux.

How about automatic session resumption and predictive character insertion to improve typing when under latency?

Since mosh relies on UDP, it's completely useless for folks who are behind proxies (e.g. for work, school, etc)
session resumption:

    tmux a
As for predictive character insertion, when i'm working in a shell, especially with high latency, i prefer my commands to be as i type them, not something some algorithm "guessed" i was going to type.
That's not what mosh is, it doesn't predict what you're going to type. It however proactively renders the characters you type before it receives confirmation from the tty on the other end.

In other words, imagine typing ssh somebox.typo.com and waiting 1 second before the text renders and discovering the typo, then pressing backspace, waiting a while for the backspaces to render, then going through all of this again. With mosh you'll be able to instantly see what you typed and fix it. On high latency connections it makes a huge difference in quality of life.

> It however proactively renders the characters you type before it receives confirmation from the tty on the other end.

Basically for those with experience of text terminals genrally: local echo.

Mosh support roaming and intermittent connectivity which is really super useful if you have to debug a server on a very dodgy 3g connection in a moving train.
I just learned about mosh, ty. I use SSH sessions all the time and sometimes over satellite links.
tmux solves the session resumption at a lower level. You can have a connection from home, jump on a train, open your laptop and keep typing and do the same when you get into the office. You don't need to re-auth each time (or deal with delayed disconnects).

It works well WITH tmux, not instead of tmux.

Which means your solution would be something like:

  while true; do
    ssh -t ${HOST} tmux a
  done
But that lacks the other benefits, especially having to wait for the session to timeout.. Take a look at: https://en.wikipedia.org/wiki/Mosh_(software)#Performance
It doesn't guess. It sinoly has local echo, and the characters that are not-yet-ack'd are underlined. Changes your life when working with 175ms+ latency
I don't think you missed anything.. I'm pretty sure I've seen a few similar apps like this on HN, but I don't really understand the draw of them over just using ssh's built in options.. You can even configure tunnels in ~/.ssh/config for "aliases".
I don't know if it does but I kind of assumed/hoped it did reconnect if a connection drops. But I can't find anything about it so I guess it doesn't.
Uh. I run an autossh program on the host in question. It auto-runs ssh connections when they drop, including tunnels.

https://www.everythingcli.org/ssh-tunnelling-for-fun-and-pro...

there's multiple ways to make tunnels in ssh. -L is one of them (local forwarding). basically, local, remote and dynamic forwarding are possible. there's some interesting uses for the latter 2 as well so if you only know -L it might be nice to check out the other methods and how you can use those. You can for example, forward a remote localhost port of a server to your own localhost, and then have a fully encrypted channel to some internal or locally bound service. for example if some server hosts a site on it's loopback or some service is listening there which you want to interact with, then you can do it directly from your own machine instead of through an active ssh session. (for example with websites this is useful, because then you can have a graphical browser instead of links via ssh x11 forwarding or w/e)
Thank you for the feedback. Much appreciated.

Someone else opened an issue requesting that: https://github.com/davrodpin/mole/issues/22

It can bind to a local available port without having to specify what it is. Stops port clashes.
The tool can select the local port on your behalf.

It also has aliases to store configuration that user usually use, but that is comparable to the ssh config file.

This is cool, but it's not very clear to me what is the benefit of using this over autossh.

autossh detects and restarts broken tunnels and uses aliases and tidy config files: https://www.everythingcli.org/ssh-tunnelling-for-fun-and-pro...

Just syntax, I think. autossh was kind of a pain for me to set up and debug.
But does your autossh have a beautiful web page? Didn't think so!
The tool can select the local port on your behalf. One less thing to configure :)
Here are the example commands, with the SSH equivalent. There's a small syntax difference, but otherwise I don't think this tool adds much.

  $ mole -local 127.0.0.1:3306 -remote 127.0.0.1:3306 -server example@172.12.0.100
  $ ssh -L3306:127.0.0.1:3306 example@172.12.0.100

  $ mole -v -local 127.0.0.1:8080 -remote 172.17.0.100:80 -server user@example.com:22 -key ~/.ssh/id_rsa
  $ ssh -v -L8080:172.17.0.100:80 -p 22 -I ~/.ssh/id_rsa user@example.com

  $ mole -v -local 127.0.0.1:8080 -remote 172.17.0.100:80 -server example1
  $ ssh -v -L8080:172.17.0.100:80 example1

  $ mole -remote 172.17.0.100:80 -server example1
  $ ssh -L2937:172.17.0.100:80 example1
  NB Random port is predefined to be 2937, see https://xkcd.com/221/. Or use $RANDOM.

  $ mole -v -local :8080 -remote 172.17.0.100:80 -server example1
  $ ssh -L8080:172.17.0.100:80 example1
  NB difference with SSH, -L:8080... would bind the local port to 0.0.0.0:8080.

  $ mole -v -local 127.0.0.1:8080 -remote :80 -server example1
  $ ssh -L8080:127.0.0.1:80 example1

  $ mole -alias example1 -v -local :8443 -remote :443 -server user@example.com
  Add to SSH config: "LocalForward 8443 localhost:443"
I don't know if Mole supports it, but SSH also has the option to forward a remote port through the local machine.

  home $ ssh -R8888:example.net:80 work.example.com
  ...
  work $ curl -H "Host: example.net" localhost:8888
But the most useful of all is perhaps:

  work $ ssh -D3128 personal-vm-or-raspberry-pi-whatever.example.net
Then configure Firefox to use a SOCKS proxy on localhost:3128. You now bypass any corporate HTTP proxy.
mole also doesn't seem to support DynamicForward for creating SOCKS proxies. Mind you, I'm not sure how it could improve on native ssh for concision:

    ssh -D *:1080 work
Combined with a .pac file that proxies my work domain(s) through the tunnel, it's all the forwarding I ever need.

ETA: largely redundant comment now the parent now also mentions this option. :)

I think it's worth drawing attention to it. It's a very useful feature; just don't tell the network administrators.

NB including

  *:
does mean anyone on your local network (assuming a firewall at the gateway) can use your computer to proxy to work. That's great if you're on a private LAN and want to look at a work site on your phone, but not great at a coffee shop.
> You now bypass any corporate HTTP proxy.

Assuming that said corporation isn’t blocking random ssh connections with their fancy NGFW. ;)

Yeah, this hits close to home. Our corp firewall blocks anything other than 80 and 443, and MITM's 443.
And when that proxy is worth it's salt, it shall detect attempts to tunnel plain ssh over said ports.

This is 2018, anyone who can bypass their corporate proxy with that example, should find employment elsewhere or atleast prepare to do so since your company's internals will surface on twitter any time now.

There is another interesting example:

$ mole -v -remote :80 -server example1

The missing "-local" flag will make mole to listen on a random local port.

If you like this, but think that SSH tunnels are too complicated, I must suggest that you try https://www.zerotier.com/.

ZeroTier solves all your networking needs and much more, the thing is pure power.

For web services, an alternative that doesn't require your own server is localtunnel:

https://localtunnel.github.io/www/

because it is very difficult to type this instead?

ssh -L 21234:localhost:1234 bob@server.com

I will confess that I googled it numerous times until one day I realized how silly and obvious it was and now it's burned into my brain...

What do you guys think of that cross-distro, Linux installation method?

curl -L https://... | tar xz -C /usr/local/bin

This command actually fails if /usr/local/bin doesn't exist. He could simplify it by releasing the binary alone and running `curl -L --create-dirs -o /usr/local/bin/mole https://...`, but my guess is uncompressed it's huge. (edit: possible that the GitHub server would support `curl --compressed ...`, allowing the HTTP connection to compress it in transit)
That is already supported:

curl -L https://github.com/davrodpin/mole/releases/download/v0.2.0/m... | tar xz -C /usr/local/bin

And there are plans to implement a script to improve this process: https://github.com/davrodpin/mole/issues/19

I have a number of connections I need to maintain - e.g. have reopened automatically - and I've been using Secure Pipes on Mac for a couple months now, very happy with it.

https://www.opoet.com/pyro/

For many purposes, users may want to consider spiped as a simpler and more reliable alternative.
This is maybe a nicer syntax around autossh, which just uses the ssh. And the functionality is ssh's '-R' flag.
I guess we won't need IPv6 that much.
What about reverse & dynamic ssh tunnels? (ssh -R or ssh -D instead of ssh -L)
So is ~C !!
Sadly, the tilde commands don't work at all if you're using ControlMaster.
Very nice. I'd consider pinging the guys of OpenBSD to suggest upstreaming this interesting, user friendly, syntax into SSH itself.
is the ssh syntax for doing the same thing really that bad ?

I find it easy to remember, it's just one flag (-L) with local_port:remote_ip:remote_port

to forward local port 3306 to mysqlhost:3306:

    ssh -L 3306:mysqlhost:3306
The strength of using ssh is that you can forward multiple ports with the same connection. i.e.

    ssh -L 3306:mysqlhost:3306 -L 8080:webhost:80
If it's easy for you to remember ssh syntax, then for you ssh is the better tool. As far as I'm concerned, I never remember the different syntax between -L, -R, -D, etc. Always have to read a doc somewhere.

In the same topic, do you remember the syntax of tar? I don't. https://www.xkcd.com/1168/

I use tar daily, so yes, i remember the syntax :)

copy files from a to b:

    (cd /src && tar cf - .) | (cd /dest && tar xf -)

operations are easy :(c)reate, e(x)tract, (t)est options the same: (f)ile, (v)erbose, g(z)ip compression. the only illogical ones is bzip2 compression and xz compression with -j and -J

I think i can remember cpio syntax as well, though i haven't used that i a decade, but did use it quite often in my old sysadm job.

copy files from a to b by piping :

    find /somewhere -print | cpio -o | (cd /destination && cpio -i)
or simply for all you kids:

    find /somewhere -print | cpio -p /destination
Well, it turns out we have different expectations regarding those tools.

My brain chooses to store other things in life.

This seems to imply that he is not 'storing other things in life' because he's able to remember that L=local forwarding R=remote forwarding and D=socks proxy
It was fun when I mixed up source and destination in my tar command and overwrote 4 hours of work ;)
You can do the same thing with the ~/.ssh/config file. Add a configuration block for the host you want to connect to with the ports you want to map. I agree that an official user interface to editing the config with the most common examples would be really handy.
This is a fantastic tool! I've always had to reference a markdown file with SSH tunnel syntax whenever I wanted to create one. I can see myself using this quite a bit in the future.
Is the syntax difference really that interesting? It's

    mole -local 127.0.0.1:3306 -remote 127.0.0.1:3306 -server example@172.12.0.100
vs

    ssh -L 3306:127.0.0.1:3306 example@172.12.0.100
With the extra installation of mole on top.
This whole thread makes me think of Alan Cooper, and how he bashes developers in The Inmates Are Running the Asylum basically as people out of touch with the rest of humanity in that we got used to rudimentary tools and our love for them and maybe the time and pain spent learning them makes us victim blame users, not that your comment is doing that, but maybe we do that unconsciously. I was going to comment on the whole persona thing he started but it’s to early in the morning for such things