`forwardOut` where local listener is unix domain socket

[ggoodman]

I wasn't able to figure out how to get forwardOut-like behaviour over unix domain sockets.

I would like to create a tunnel to a remote ssh server and create a local forwarder that is a unix socket instead of a port.

The reason that I need to do this is that the service that needs to do this is running in a --net=host Docker container in a multi-tenant environment. This means that opening a port would make the tunnel open to any other tenant whereas the environment provides a namespaced r/w filesystem.

Any ideas? Thanks for ssh2. It is mind-blowing what can be done in pure js and how easy it is to use thanks to this lib.

[mscdex]

If the server is OpenSSH 6.7+, you can use openssh_forwardOutStreamLocal().

If the server is not OpenSSH or is an older version of OpenSSH, you could execute socat (via exec()) on the server and access the socket that way.

[ggoodman]

In the first case, how would I initiate the ssh-authenticated remote-host to local socket connection? Forgive me but I'm not an expert on built-in unix tools for this sort of thing.

As for the second suggestion, can you give me a little bit more of a hint as to how that would work? I don't quite understand.

Thanks for the suggestions!

[mscdex]

Perhaps I misunderstood what you're trying to do. You have a node process that is listening on a local unix domain socket and you want to forward incoming connections on it over ssh? Are you forwarding these connections as TCP or unix domain sockets on the server side? forwardOut() initiates a TCP connection on the server side, whereas openssh_forwardOutStreamLocal() would initiate a unix domain socket on the server side.

Or are you trying to go the other way around, have a unix domain socket listening on the ssh server side that forwards connections to your node process?

[mscdex]

@ggoodman Were you still having an issue with this?

[ggoodman]

@mscdex thanks for reminding me about this.

Let me explain the environment and perhaps that will clarify what I'm trying to do and why.

I'm using ssh2 to tunnel through a NAT box to a database sever on in a private subnet. The environment in which I'm running ssh2 has some unusual characteristics:

• Runs in an ephemeral Docker container in a multi-tenant environment
• Docker us being run with host networking mode meaning all tenants share the same network namespace
• Each tenant has a private volume

Other constraints:

• Database driver doesn't have native ability to tunnel its connections over ssh
• Database driver is able to connect via unix domain socket

Considering these, I had hoped to open a tunnel on a unix domain socket that connects to the database server since then it would be restricted by filesystem permissions to the active tenant. The database driver could then connect to that local unix domain socket.

The alternative is to open a local listener on a random port that tunnels over to the database server. The downside with that alternative approach is the risk that another tenant could guess the port (Note that the database does require login, but I would like this extra layer of security).

Does this help explain the context?

[mscdex]

So you mean something like:

var net = require('net');
var Client = require('ssh2').Client;

var sshConfig = {
  // ...
};
// 127.0.0.1 here means the same machine as the ssh server
var DB_REMOTE_IP = '127.0.0.1';
var DB_REMOTE_PORT = 54321;

net.createServer(function(sock) {
  var conn = new Client();
  conn.on('ready', function() {
    conn.forwardOut('127.0.0.1',
                    12345,
                    DB_REMOTE_IP,
                    DB_REMOTE_PORT,
                    function(err, stream) {
      if (err) {
        conn.end();
        return sock.writable && sock.end();
      }

      if (sock.readable && sock.writable) {
        stream.pipe(sock).pipe(stream).on('close', function() {
          conn.end();
        });
      } else
        conn.end();
    });
  }).on('error', function(err) {
    sock.writable && sock.end();
  }).connect(sshConfig);
}).listen('/path/to/socket');

?

That listens on a unix socket, connects to some ssh server for each connection on that unix socket, and pipes traffic between the incoming unix socket connection and a new connection to some remote server from the ssh server (either local or otherwise).

[ggoodman]

That looks like exactly the sort of thing I'm trying to accomplish! Thank
you for the detailed example.

I will give this a whirl next week. I think you can safely close this
issue. I will ping you if I find any issue.

Cheers!

On Sat, Mar 5, 2016 at 12:24 PM Brian White notifications@github.com
wrote:

So you mean something like:

var net = require('net');var Client = require('ssh2').Client;
var sshConfig = {
// ...
};var DB_REMOTE_IP = '127.0.0.1';var DB_REMOTE_PORT = 54321;
net.createServer(function(sock) {
var conn = new Client();
conn.on('ready', function() {
conn.forwardOut('127.0.0.1',
12345,
DB_REMOTE_IP,
DB_REMOTE_PORT,
function(err, stream) {
if (err) {
conn.end();
return sock.writable && sock.end();
}

  if (sock.readable && sock.writable) {
    stream.pipe(sock).pipe(stream).on('close', function() {
      conn.end();
    });
  } else
    conn.end();
});

}).on('error', function(err) {
sock.writable && sock.end();
}).connect(sshConfig);
}).listen('/path/to/socket');

?

That listens on a unix socket, connects to some ssh server for each
connection on that unix socket, and pipes traffic between the incoming unix
socket connection and a new connection to some remote server on the ssh
server (either local or otherwise).

—
Reply to this email directly or view it on GitHub
#391 (comment).