MAMayeulC·Jan 27, 2020
This is interesting, but how does it work? By leveraging a STUN/TURN server? Can we connect on port 22?
Actually, there is this link in the subtitle (and in the readme, but only mentions "getting started", now "how does this work"): https://shellhub-io.github.io/ this should probably be the story link.
So, short answer to my question (though I had to read https://github.com/shellhub-io/shellhub/commit/fb0ebf10b1270... to understand it, the website wasn't enough):
* You host a TURN-like server somewhere
* You locally host an ssh server (see the above commit: using docker)
* When you ssh to the local server, the TURN server is contacted, and performs the handshake; your local server proxies to the remote one on the right port
This is an interesting proof-of-concept, but:
* I wish people would deploy ipv6 without (or with minimal) firewalls
Read the rest
instead
* As with all TURN, doesn't work with symmetrical NATs
* This is a bit overkill. If I could ssh into the TURN server and have it reply with the right ssh command, it would work as well (need to be quick)
Given the above, this could be built into ssh: specify a TURN server (or plain ssh host) to negociate a port and have the client & server perform the handover.
The way I do NAT traversal usually is to setup a reverse tunnel between the target sshd and another server (initiated by the target host), which I then proxy/jump on with `-p`. Obviously this uses some of the server's bandwidth, hence my proposed offer to add something like TURN negotiation on the server. The intermediate server doesn't even need to be aware of this, if you can execute arbitrary commands.
I wish more applications were compatible with something like this. The Internet really is broken if we have to jump trough these hoops to get any p2p going. There might be a way to do it in a way that's transparent to the application, but we might need a new TCP for this. I wonder if Yggdrasil or GNUnet offer to solve that kind of issues over the current TCP network (making a VPN of sorts between the computers, but not firewalled/NATed).