[solved] http through ssh

[Fillepe The Mexican]

Hello, I have an interesting porblem that I was hoping you might be able to help me solve. Currently I am doing an e-commerce course and am learning ASP.

The lab that they provide us is has about half as many computers as nessacary and as such it is difficult to get a machine. As ASP needs IIS to work properly I have set myself up a server at home on a Win2000 box I had. This works great when I'm at home but i'd like to be able to access it from varsity. I could just expose it to the net but I don't know the first thing about locking down IIS and really don't like the idea of having a poorly configured web server on my network (or a webserver at all for that matter ).

What I want to try and do is threefold

1. Set up an ssh tunnel to my linux machine that tunnels a port (say 1080) to my gentoo box at home.

2. The gentoo box recieves the traffic through ssh on 1080 and rebroadcasts it on port 80 to my Win2K box.

3. The win2K box recieves the web request on port 80 and replies.

4. Gentoo box sends it back to varsity on port 1080 through ssh

Now I don't actually know how to port forward through ssh but I can find out so this is not my question. The question that I have is how to accomplish parts 2 and 4. Is anybody able to provide me with a reasonably easy to understand reference on how to do it or possibly provide the rules for IP tables to achieve the desired results?


Thanks

Fillepe

[Gherald]

why not just open your win2k machine to the world on some obfuscated port (9222 off the top of my head) and leave the rest firewalled with e.g. zonealarm?

simple is better...

[jdgill0]

If you are not absolutely requiring ssh, you could use rinetd, it's description

[Fillepe The Mexican]

These ideas would both work however I still have one potential problem with both of these ideas if I understand post 3 correctly would just expose the server on another port. I know that having an unsecured/poorly secured IIS server on port 80 is suicide. How much is the risk of worm infections mitigated by running on a non-standard port? It could still determine a web server was available from a port scan could it not?


If it was tunneled through ssh it would not be open to any machine that I was not personally logged into. Is this an accurrate appraisial?

[nielchiano]

[Percius]

You can open the port, but if you aready have SSH setup and secured. Remember that SSH can mean potential remote root access as you are running a program that is designed to give access.

I am going to Presume that you are useing a Windows box at LocationX. The program I use for SSH is Putty
Free from http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html

In the putty Window on the Side you have Connections --> SSH --> Tunnnels.

Source Port is the port that is going to accept the data on the local machine IE 1080 or whatever.

Destination is where that information is going to go. It should be 192.168.xxx.xxx:80 where the IP is that of your windows box.

If you save your configuration in putty then you wont have to enter it again every time.

This only works if you enable Port forwording in SSH on your server. That option is found in /etc/ssh/sshd.conf if my memory serves me correctly.

The setup used above would mean that http://127.0.0.1:1080 would redirect you to your M$ evil machine running ASP.

If you need more help please let me know otherwise I recomend you put [SOLVED] in the thead tile.

[Fillepe The Mexican]

Ok the answers I need are in fact here I just gotta get this sorted in my head.

The machine that I am running on a "Location X" (actually university) is actually a fedora core 3 machine. The whole dilema stems from the fact that I want to develop on these machines and at home and not have to touch the WinXP/Frontpage nastyness.

The Plan (tm)
1. Setup ssh tunnel of port 1080 from uni FC3 box to home Gentoo box.

2. Setup home Gentoo box to use port forwarding in sshd.conf

3. On uni box connect to http://localhost:1080

4. Profit?


Well igonoring the poor slashdot jokes I'll let you know how this gets on.

Thaks for the help.

[taskara]

or via the ssh command..

[Fillepe The Mexican]

Well I can now safely say it worked. I can now access my Win2k server from uni. It is not available to anybody on the public net. The ssh account also operates in a passwordless chroot jail using private/public keys. Yay!

The following config is fairly straight forward but for the benefit of anybody looking for a solution I have included my ssh_config.
This is in te client side file ~/.ssh/config