Hacker News new | ask | show | jobs
by jlgaddis 4719 days ago
I haven't looked at it all, but it sounds like you're wanting something like the functionality that SSH's "ProxyCommand"?

As an example, we lockdown our servers so that they are only accessible via SSH from a few hosts. I got tired of SSH'ing into server A just to SSH into server B, so I set up my ~/.ssh/config file so that when I "ssh serverB", it uses the ProxyCommand functionality to basically do that for me.

Here's what it looks like in ~.ssh/config:

    Host serverB
        ProxyCommand ssh serverA.example.com -W %h:%p
When I "ssh serverB", it connects to serverA first and then connects to serverB. I could be wrong but it sounds like that is what you were talking about.
1 comments
cpenner461 4719 days ago
Pretty close yeah, except that serverB is only listening on a private IP, and I want to connect to it in by web browser (http). My primary use case is with hadoop clusters, where I access the jobtracker ui on the public hostname, but when I drill down into task logs it points to private/internal IPs. FoxyProxy allows me to access the private IPs directly/transparently, but I do most of my browsing with Chrome these days, so it'd be nice to just be able to do it all in one browser.

ProxyCommand looks pretty cool though, wasn't aware of it - thanks!

link
jlgaddis 4719 days ago
> ... except that serverB is only listening on a private IP and I want to connect to it in by web browsing (http) ...

Still possible, with ssh's "-D" option that basically turns a remote SSH server into a (HTTP) proxy server!

    $ ssh -D 4444 serverA.example.com
Log in and keep this session active.

In your browser (I use a separate browser, permanently configured this way), configure it to use a (SOCKS5) proxy server for all traffic. The proxy server should be "localhost:4444".

In your address bar, navigate to "http://serverB.example.com". The HTTP traffic is sent over the SSH tunnel to serverA and from there it goes out to the network to its destination. To the destination server (serverB), it appears that the request originated from serverA and that's where the response will go (at which point it is again encrypted and sent over the SSH tunnel back to your local machine). Visit http://icanhazip.com (or a similar site), for example, and you'll see that, to the remote web server, it appears that traffic is coming from serverA.

This isn't the most eloquent explanation, sorry. Look into "SSH socks proxy" and you should find much better explanations. It's really much easier than it sounds! =)

link