Reverse SSH Tunnel: Export Your Mac Laptop to the Internet

Want to get at your Mac remotely and securely without having to resort to VNC? Check out this post as we walk through how to do just that.

Denny Zhang

Oct. 11, 16 · Tutorial

Likes (2)

Comment

Save

6.6K Views

as most professional programmers, we use macs quite a lot in daily work. but did you know we can easily export our data to the internet? trusted people can access our laptop directly from anywhere . keep in mind, this is definitely for temporary use. it could be ssh operations or various web services.

here is a simple and complete guy to teach you how to do just that in 10 minutes. if you like it, share it.

let’s say you’re working remotely and you need to share some of your work with your colleagues or clients. what would you do? take screenshots with a lot of explanations? start an ec2 instance, do the setup again, and migrate your current work there? that all takes money and time. a lot of extra time. worse than that, it compromises our result. what if we could easily export our laptops directly to the audience?

here, we just focus on mac os x, but t he same technique would apply to all linux boxes. theoretically speaking, it would work for ubuntu or centos with some minor changes.

below, we try to:

export an ssh service from our mac laptop. tech geeks are addicted to ssh, right?
export a web service . here, we use apache. it is installed by default in mac os x.

the main trick is the ssh reverse tunnel.

preparation

a vm in a public cloud : we need a public ip to do the proxy. don’t worry, the resource overhead is very small.
root access for the vm : we need this to configure sshd, and/or iptables.

1. configure your public vm

make sure the sshd config file contains gatewayports clientspecified.

# mac: vim /etc/sshd_config
# ubuntu/centos: vim /etc/ssh/sshd_conf

if the vm has iptables enabled, make sure it allows incoming traffic for port 40062 and 8088.

# use ufw for ubuntu env
ufw allow 40062/tcp
ufw allow 8088/tcp

# or use iptables directly
iptables -a input -i eth0 -p tcp --dport 40062 -j accept
iptables -a output -o eth0 -p tcp --dport 40062 -j accept
iptables -a input -i eth0 -p tcp --dport 8088 -j accept
iptables -a output -o eth0 -p tcp --dport 8088 -j accept

we use 40062 to do the ssh reverse tunnel so that people can ssh to our laptop. as for web services, we start apache in our laptop — it listens on port 80. then, we set up port forwarding from 8088 to 80 in this vm.

for better security, only allow traffic from trusted source ip addresses.

2. enable ssh service in your laptop

for security concerns, mac os doesn’t enable ssh remote login. let’s turn it on: system preferences -> sharing -> remote login. then verify by " telnet localhost 22 ."

3. start ssh reverse tunnel in your laptop

# replace below with your vm's public ip
export vm_ip=your_vm_ip

# perform ssh reverse tunnel
# parameters: -r(reverse tunnel), -4(ipv4)
# here we choose 40062 to do the tunnel.
ssh -4 -v -p 22 -fn \
-o "pubkeyauthentication=yes" \
-o "stricthostkeychecking=false" \
-o "passwordauthentication=no" \
-o "serveraliveinterval 60" \
-o "serveralivecountmax 3" \
-r $vm_ip:40062:localhost:22 root@$vm_ip

# verify connection
telnet $vm_ip 40062

showtime! run this: ssh -p 40062 root@$vm_ip from any machine. input the root password of your laptop. then people can ssh your laptop now!

4. export your website to the internet

we want to simulate exporting web services. mac os x preinstalls apache.

let’s start apache in our laptop.

# start apache service in mac
sudo apachectl start

# verify apache works
curl http://localhost

in vm, ssh tunnel from $vm_ip:8088 to port 80 in our laptop.

# ssh tunnel for port forwarding
ssh -v -n -p 40062 -f root@$vm_ip \
-l *:8088:localhost:80 -n /bin/bash

in any other machines, visit http://$vm_ip:8088 in a web browser.

what if i don’t need it anymore?

simply kill the process in your laptop, which runs ssh reverse tunnel.

# find pid in mac
ps -ef | grep 40062

# kill process. if it fails, use 'kill -9'
kill $pid

# verify it's done

ps -ef | grep 40062

telnet $vm_ip 40062

use autossh to handle "ssh connection unstable"

quite naturally, an ssh connection might break up in our laptop. network turbulence or the computer goes to idle or hibernate.

autossh : automatically restart ssh sessions and tunnels. let’s set up the auto connection with autossh.

# install autossh
brew install autossh

# verify installation
which autossh

to take effect, let’s make a small change in step #2 of the ssh reverse tunnel.

from:

ssh -4 -v -p 22 -fn \
-o "pubkeyauthentication=yes" \
-o "stricthostkeychecking=false" \
-o "passwordauthentication=no" \
-o "serveraliveinterval 60" \
-o "serveralivecountmax 3" \
-r $vm_ip:40062:localhost:22 root@$vm_ip

autossh -m 40063 -4 -v -p 22 -fn \
-o "pubkeyauthentication=yes" \
-o "stricthostkeychecking=false" \
-o "passwordauthentication=no" \
-o "serveraliveinterval 60" \
-o "serveralivecountmax 3" \
-r $vm_ip:40062:localhost:22 root@$vm_ip

make sure your vm won’t block the traffic of port 40063. let’s verify the change, by telnet $vm_ip 40062 .

all good? then congratulations, you're set!

Internet (web browser) Web Service

Published at DZone with permission of Denny Zhang, DZone MVB. See the original article here.

Opinions expressed by DZone contributors are their own.

Related

Trending