Search the Community

SSH Tunneling SSH Tunneling What is SSH Tunneling? SSH tunneling (also called as SSH port forwarding) is a method of transporting arbitrary networking data over an encrypted SSH connection. SSH tunneling is the process by which a TCP/IP connection is tunneled inside a secure SSH tunnel. It can be used to add encryption to legacy applications. It can also be used to implement VPNs (Virtual Private Networks) and access intranet services across firewalls. It protects the tunneled connection from network attacks. Application data traffic is directed to flow inside an encrypted SSH connection so that it cannot be eavesdropped or intercepted while it is in transit. SSH tunneling enables adding network security to legacy applications that do not natively support encryption. The SSH connection is used by the application to connect to the application server. With tunneling enabled, the application contacts to a port on the local host that the SSH client listens on. The SSH client then forwards the application over its encrypted tunnel to the server. The server then connects to the actual application server - usually on the same machine or in the same data center as the SSH server. What is SSH port forwarding in Linux? SSH port forwarding establishes a secure connection between a local computer and a remote Linux machine through SSH protocols which can delay services. You need to give your client your source and destination port numbers to use SSH tunneling in Linux. You also need to provide the location of the destination server, which can either be a hostname or an IP address. Who uses SSH tunneling? Any user who is able to log into a server can enable port forwarding. Hackers and malware can similarly use it to leave a backdoor into the internal network. It can also be used for hiding attackers's tracks by bouncing an attack through multiple devices that permit uncontrolled tunneling. Types of SSH port forwarding • Local port forwarding • Dynamic port forwarding • Remote port forwarding How does SSH port forwarding work? Port forwarding starts with the packets that are generated when you forward a data request over the Internet. Your network router will typically assess the header of an IP packet and forward it to the connected and proper interface. This will then transfer the data to the target information in the header. However, with port forwarding, the intercepting device or application browses the packet header, takes note of the destination, and later modifies the header information. This is then sent to a different computer than the one intended. The subordinate host destination may have a different port on the same IP address, a different IP address on the same port, or a totally different mixture of the two.