Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: RDP over SSH Tunnel
Special Forums Cybersecurity RDP over SSH Tunnel Post 302717853 by DGPickett on Thursday 18th of October 2012 04:31:05 PM
Old 10-18-2012
Semantics cn cloud the issue. Every PC with RDP is a server, and the support dude has the client. The tcp client sends the first packet SYN, and if there is a listening socket, that replies with the second, reply packet SYN ACK. An ssh tunnel listens on one end of the ssh session host pair on some specified port, as a server, and forwards connections to the opposite end host to a new client socket connected to the host and port specified. So, ssh is the obvious tool, as long as one end is visible to each end. If you ssh localhost, the two middle hosts can be the same host.

Suppose on host A you "ssh -L 3389:C:3389 B", forwarding A:3389 to new client connections on B (high port) to port 3389 C, which is the target PC to be serviced port 3389. When your tech points his RDP client host D to A:3389, it will really be talking to the target PC RDP service. The RDP client D connects a socket on D:high-port to A:3389, A sends via ssh client app inside ssh connection to sshd server on B, which makes a new socket, connects it to C:3389, and everyone shuffles data flow both ways.

Security rules sometimes prevernt -L, but sometimes -R is legal, where the listening server part of the tunnel is on the sshd server end, and the new client sockets originate on the ssh client app.

Often, the problem is really simpler, and all that is not needed. A firewall E in the middle may able to see both C and D even though they cannot see each other, like if C is on the internet and D is on a 10. unroutable address. Using NAT or tcpRelay, it can listen for D and connect to C.

Now, if you want a dynamic service where many PCs can be the target, something like a web service could set up the forwarder or tunnel to the indicated host. For security, it is nice if there is a timeout and some filtering of incoming connections, so only D can temporarily get that connection to C:3389.
 

6 More Discussions You Might Find Interesting

1. Programming

using a ssh tunnel with nx compression

hi everybody and thank you for this wondefrul forum this is my first thread posted here and i hope that i could find some help from your part (i am even sure) :D here is the situation: i am to develop an application of remote desktop access such as vnc, vpn and especially nx i want to develop... (0 Replies)
Discussion started by: bolboln01
0 Replies

2. UNIX for Dummies Questions & Answers

SSH tunnel working for ssh but not for sshfs

I'm trying to setup a link between my home pc (work-machine) and a server at work (tar-machine) that is behind a gateway (hop-machine) and not directly accessible. my actions: work-machine$ ssh -L 1234:tar-machine:22 hop-machine work-machine$ ssh -p 1234 user@127.0.0.1 - shh access on... (1 Reply)
Discussion started by: Vathau
1 Replies

3. IP Networking

Help with SSH tunnel?

I have a Java web app on machine (X) that needs to talk to an LDAP server (Y) on :636, but the LDAP server is only accessible on a particular network. I can login to a machine (Z) on that network from X, and this machine can talk to the LDAP server on :636. How can I tunnel so that X can... (2 Replies)
Discussion started by: spacegoose
2 Replies

4. IP Networking

VPN ssh access over RDP port?

Guys, Can I use an open RDP port to gain ssh access to my Linux server running the other side of our firewall? I work from home on the odd occasion, we only have RDP port 3389 available once logged into the VPN. I would rather ssh into my workstation without the need for a desktop display. ... (3 Replies)
Discussion started by: general_lee
3 Replies

5. Solaris

Tunnel X over ssh for 11.3

Hello Solaris experts: Trying to bring the 11.3 gdm screen over ssh to a Linux Box: I did the following: 1. made chanes to /etc/ssh/sshd_config & bounced ssh daemon: # X11 tunneling options X11Forwarding yes X11DisplayOffset 10 X11UseLocalhost yes 2. From the remote Linux box: ... (6 Replies)
Discussion started by: delphys
6 Replies

6. UNIX for Advanced & Expert Users

Tunnel using SSH

I am not clear with the part of concept of Tunneling using ssh. ssh -f -N -L 1029 192.168.1.47:25 james@192.168.1.47 I found out that above code works for me . but didn't quite well understood how ti works and need to ask you guys some questions. since we are using tunnel through ssh ... (2 Replies)
Discussion started by: lobsang
2 Replies

LEARN ABOUT DEBIAN

gnunet-vpn

GNUNET-VPN(1)						      General Commands Manual						     GNUNET-VPN(1)

NAME

       gnunet-vpn - manually setup a GNUnet VPN tunnel

SYNOPSIS

       gnunet-vpn [options]

DESCRIPTION

       gnunet-vpn  can	be  used  to manually setup a VPN tunnel via the GNUnet network.  There are two main types of tunnels.	Tunnels to an exit
       node which routes the traffic to the global Internet, and tunnels to a node that runs a service only within GNUnet.  Depending on the  type
       of  tunnel, gnunet-vpn takes different options.	The "-i" option is required for tunnels to an exit node, whereas the "-p" and "-s" options
       in conjunction with either "-u" or "-t" are required for tunnels to services.  For exit tunnels, both UDP and TCP  traffic  will  be  redi-
       rected.	For service tunnels, either UDP ("-u") or TCP ("-t") traffic will be redirected.

       The  tool  will	display the IP address for this end of the tunnel.  The address can be displayed as soon as it has been allocated, or only
       after ("-a") the tunnel has been created.

OPTIONS

       -4, --ipv4
	      Desired IP address on this end of the tunnel should be an IPv4 address.

       -6, --ipv6
	      Desired IP address on this end of the tunnel should be an IPv6 address.

       -a, --after-connect
	      Display IP address only after the tunnel is fully connected.

       -c FILENAME,  --config=FILENAME
	      Use the configuration file FILENAME.

       -d SEC, --duration SEC
	      The mapping should be established for SEC seconds.  Default is 5 minutes.

       -h, --help
	      Print short help on options.

       -i IP, --ip IP
	      Tunnel should be to an exit node and connect to the given IPv4 or IPv6 IP address.  Note that you can specify an IPv6 address as the
	      target here, even in combination with "-4" (4to6) and similarly you can specify an IPv4 address in combination with "-6" (6to4).

       -L LOGLEVEL, --loglevel=LOGLEVEL
	      Use LOGLEVEL for logging.  Valid values are DEBUG, INFO, WARNING and ERROR.

       -p PEERID,  --peer=PEERID
	      Name of the peer offering the service to connect to.  Cannot be used in conjunction with "-i", requires "-s".

       -s NAME,  --service=NAME
	      Name of the service running on the target peer.  Cannot be used in conjunction with "-i", requires "-p".

       -t, --tcp
	      Service runs TCP.  Either "-t" or "-u" must be specified when using "-s".

       -u, --udp
	      Service runs UDP.  Either "-t" or "-u" must be specified when using "-s".

       -V, --verbose
	      Be verbose.

       -v, --version
	      Print GNUnet version number.

BUGS

       Report bugs by using Mantis <https://gnunet.org/bugs/> or by sending electronic mail to <gnunet-developers@gnu.org>

SEE ALSO

       gnunet-setup(1)

GNUnet								    25 Feb 2012 						     GNUNET-VPN(1)
All times are GMT -4. The time now is 12:41 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy