So let’s talk about the case of not having ports exposed next, since this was the entire reason I wanted to write this post! SSH Tunnel with Socket “pick a port above this range and hope that no other user picks the same one!” It’s messy. That ports are exposed on the login node! It’s probably better that way, because in cases where you do get ports it’s sort of a At least at my current employer it’s not even the case I’m not sure in practice how common this is anymore. $ ssh ' $DOMAINNAME ' -l $FORWARD_USERNAME -K -L $PORT: $MACHINE: $PORT -N & The ssh command in this case utilizes the flag -K that forwards the login credentials to the compute node: Not Isolatedįor HPCs where the compute node is not isolated from the outside world the ssh command for port forwarding first establishes a connection the login node, but then continues to pass on the login credentials to the compute node to establish a tunnel between the localhost and the port on the compute node. The -N says “don’t execute a remote command (and just forward the port).”įinally, the last $MACHINE is the node that the jupyter notebook is running on.

You’ll notice it looks just like the first, and this works because ssh commands can be chained. The next line ssh -L $PORT:localhost:$PORT -N '$MACHINE' & is a second command run from the login node,Īnd port forwards it to the compute node, since you can only access the compute node from the login nodes. Since we are forwarding ports, this would require minimally the login node to expose ports. Warded over the secure channel, and a connection is made toĮither host port hostport, or the Unix socket remote_socket,įorward whatever is running on the second port on my resource to my local machine. Made to the local port or socket, the connection is for‐ Port on the local side, optionally bound to the specifiedīind_address, or to a Unix socket. This works by allocating a socket to listen to either a TCP Given host and port, or Unix socket, on the remote side. Specifies that connections to the given TCP port or Unix socket on the local (client) host are to be forwarded to the The “-L” in the above (from the man pages) : I think the restricted shell suggestion, made in some previous answers, is also a good idea.$ ssh -L $PORT:localhost: $PORT $) is executed on the local machine, which establishes a port forwarding to the login node. The command supplied by the user (if any) isĪttempts to use scp secure file copying will also fail with an echo of 'do-not-send-commands' I've found sftp also fails with this configuration. Specifies that the command is executed whenever this key is usedįor authentication. The command='/bin/echo do-not-send-commands' echoes back 'do-not-send-commands' if someone or something does manage to send commands to the host via ssh -T or otherwise.įrom a recent Ubuntu man sshd, authorized_keys / command is described as follows: The permitopen explains what ports are allowed to be forwarded, in this case port 6379 the redis-server port I wanted to forward. No-pty,no-X11-forwarding,permitopen='localhost:6379',command='/bin/echo do-not-send-commands' ssh-rsa rsa-public-key-code-goes-here no-pty trips up most ssh attempts that want to open a terminal. On the remote 'somehost' Here is what I used for authorized_keys: cat. Specifically I have a redis-server on 'somehost' bound to localhost:6379 that I wish to share securely via ssh tunnels to other hosts that have a keyfile and will ssh in with: $ ssh -i keyfile.rsa -T -N -L 16379:localhost:6379 will cause the redis-server, 'localhost' port 6379 on 'somehost' to appear locally on the host executing the ssh command, remapped to 'localhost' port 16379. On Ubuntu 11.10, I found I could block ssh commands, sent with and without -T, and block scp copying, while allowing port forwarding to go through.

Tell specific all to use ssh tunnel