Linux Desktop Hacks

Forward Ports over SSH #75

Chapter 9, Administration and Automation

|

231

HACK

If all has gone well, you can exit the chroot environment and reboot the sys-

tem. It should boot up as normal.

—George Wright

HACK

#75

Forward Ports over SSH Hack #75

Keep network traffic to arbitrary ports secure with SSH port forwarding.

In addition to providing remote shell access and command execution,

OpenSSH can forward arbitrary TCP ports to the other end of your connec-

tion. This can be very handy for protecting email, web, or any other traffic you

need to keep private (at least, all the way to the other end of the tunnel).

Ssh accomplishes local forwarding by binding to a local port, performing

encryption, sending the encrypted data to the remote end of the ssh connec-

tion, then decrypting it and sending it to the remote host and port you spec-

ify. Start an ssh tunnel with the

-L switch (short for Local):

root@laptop:~# ssh -f -N -L110:mailhost:110 -l user mailhost

Naturally, substitute user with your username, and mailhost with your

mail server’s name or IP address. Note that you will have to be root on lap-

top for this example, since you’ll be binding to a privileged port (110, the

POP port). You should also disable any locally running POP daemon (look

in /etc/inetd.conf) or it will get in the way.

Now to encrypt all of your POP traffic, configure your mail client to con-

nect to localhost port 110. It will happily ...