Notes on SSH tunnels

Author: Merlin Hansen
Date: 2020-03-20 / 2024-03-11

Summary

This document provides information on using SSH tunnels to access various services hosted on CSCI servers from external non-VIU computers.

Several CSCI services are on VIU private networks which are not externally accessible. To access these services one can set up a SSH tunnel through otter.csci.viu.ca to the computer hosting the service on the CSCI network. The tunnel will then allow targeted network traffic to travel from the external local computer, through otter.csci.viu.ca, and to the desired server.

Example scenarios include accessing:

This tutorial should be referenced on a as-needed basis. It is recommended to only complete the configuration for the service you currently need to access.

SSH Tunnel Resources

The following links have examples and general descriptions on how ssh tunnels work.

Prerequisites

Before attempting any of the procedures outlined below it is strongly recommended to configure SSH Keys and the SSH ProxyJump option as outlined in the CSCI tutorial Tutorial-sshClient.md, on Dave's Tech Notes page.

CSCI use of SSH tunnels

The following scenarios are typical:

For this tutorial the following is used throughout:

Accessing web pages hosted on wwwstu.csci.viu.ca

Using command line only and not utilizing an ssh config file

Accessing MySQL/MariaDB on dolphin.csci.viu.ca (wwwstu.csci.viu.ca)

Using command line only and not utilizing an ssh config file

Using a graphical Database tool such as DBeaver

DBeaver Community is a free open source tool for working with databases. It has built-in ability to connect to remote databases using direct connections, SSH Tunnels, or even SSH Jumpboxes. It is beyond the scope of this tutorial to provide specific configuration details for DBeaver. However, there is plenty of information on the DBeaver website: DBeaver.io.

Accessing a Tomcat instance running on a lab machine

Using command line only and not utilizing an ssh config file

Creating one ssh tunnel to access multiple services

Using command line only and not utilizing an ssh config file

SSH can support multiple tunnel connections to different hosts through a single tunnel via a gateway. Here the gateway is otter.csci.viu.ca and the connections are one to MySQL on dolphin (wwwstu.csci.viu.ca) and one to a Tomcat instance on cub5.csci.viu.ca.

Accessing git repositories on cscidb.csci.viu.ca from off campus

SSH tunnels can be used to establish a connection from a local computer to cscidb.csci.viu.ca via otter.csci.viu.ca. The tunnel is established in much the same way as the above examples. However, for local git commands to access repositories on csci servers additional ssh configuration must be made.

The following steps are common for both of the sections below and should be completed prior to continuing.

Now that the basic configuration is done the next step is to connect to the CSCI internal Git Server. Connecting to the CSCI Git server involves establishing a SSH tunnel through otter.csci.viu.ca to the Git server. This connection must be in place in order to use any remote Git commands.

Example Git commands which act locally only: git status, git add, git commit, git log, git stage, etc. Example Git commands which talk to the remote Git server: git fetch, git pull, git push git clone, etc. Specific CSCI Git commands which talk to the remote Git server: ssh csci info, ssh csci fork, etc.

Use one of the methods outlined in the following sections to connect to the CSCI Git server.

Without first following the SSH Client configuration tutorial

It is highly recommended that you configure your SSH setup as outlined in Tutorial-sshClient.md. However, if you decide against this then the following procedure can be used.

This method requires you to manually establish a separate SSH tunnel anytime you want to use a remote Git command. The tunnel must stay connected until you are finished the remote commands.

At this point your configuration is complete.

After completing the SSH Client configuration tutorial

Once you have completed the SSH setup as outlined in Tutorial-sshClient.md, you can use the procedure outlined below to modify your SSH config file for remote git server access.

The config file, ~/.ssh/config can be modified to use otter.csci.viu.ca as a jumpbox, similar to how one accesses a CSCI lab machine.

Host csci
    Hostname cscidb
    ProxyJump cscijump
    User csciadm
    IdentityFile ~/.ssh/csci

With the above entry in the config file CSCI Git repositories can be manipulated remotely using remote Git commands outlined previously.

Copying a file stored on a specific lab machine to a local external computer

In CSCI 251 it is typical to have a logical volume drive created on a particular lab machine for storage of large files such as virtual machines and ISO image files. Since lab machines are not directly accessible from off campus, copying files to and from these spaces directly is not possible. Two options are available:

For this example the follow assumptions are made: * The user's login name is exstu * The desired file is stored in a logical volume on cub5 (cub5:/.exstu/myfile)

Using graphical programs such as PuTTY to create ssh tunnels