Why ssh tunnel

SSH tunnels are also useful for allowing outside access to internal network resources. The SSH server may be running on the same machine as the target server, or on a different machine.

Network communications between the SSH server and the target server are NOT encrypted by the SSH tunnel see diagram below , so if the servers are running on different machines, ideally they should be located together on a secure network.

The SSH server will need to have access to the listening port on the target server. In this scenario, a client wishes to connect to a service that does not natively use encryption but does not want the traffic to be sent unencrypted through the Internet.

The environment for this scenario:. The option SSH already provides a secure way of communicating via encrypted channels. This can be done by using torsocks as:. Every other week we'll send a newsletter with the latest cybersecurity news and Teleport updates. So far, we have covered the advantages of SSH tunneling and how it makes it easy to connect to remote services, which otherwise would not be possible due to network configurations and restrictions.

But this power of SSH tunneling is also often misused by malicious users. Hiding malicious traffic within an SSH tunnel is a common classic way to go undetected inside a network. For example, read this post where android malware used SSH tunnel to access corporate network , this report which states Fox Kitten campaign using SSH tunnel , or this article describing misuse of SSH tunnels to send spam.

Detecting such activities is tough since SSH communications are encrypted, and you would not know what kind of data is transported underneath. If you are a network or security administrator, a continuous full traffic analysis within your network is a must which might give you clues such as types of SSH access performed, e.

If the patterns do not match the work stuff that SSH requires to be used within your network, it might be a good lead to start an investigation. OpenSSH, a popular open-source SSH server, supports three types of tunneling features- local port forwarding, remote port forwarding, and dynamic port forwarding.

These tunneling features help achieve security use cases such as remote web service access without exposing port on the internet, accessing server behind NAT, exposing local port to the internet, or even create a point-to-point VPN like encrypted tunnel.

SSH tunneling techniques are also frequently used by adversaries to hide malicious network traffics. As a network or security administrator, if your team or developers use an SSH tunnel, it is important to monitor traffic patterns to continuously detect anomalies in regular patterns. This can be done by first capturing packets with packet sniffing tools such as tcpdump and Wireshark and analyzing the traffic. Next - Try Teleport.

Teleport is a modern SSH server with features optimized for elastic multi-cloud environments and supports other access protocols in addition to SSH. This site uses cookies to improve service. By using this site, you agree to our use of cookies. More info. Ok, got it. Docs Documentation Developer documentation for using Teleport How it works Learn the fundamentals of how Teleport works Community Forum Ask us a setup question, post your tutorial, feedback or idea on our forum Teleport Slack Channel Need help with set-up?

Learn The blog Technical articles, news, and product announcements Our customers Learn how companies use Teleport to secure their environments Resources A collection of whitepapers, webinars, demos, and more Events View our upcoming events.

Company About us Our missions and vision for the future Careers View our available career opportunities News Featured publication from around the web. What is SSH tunnelling? This invisibility carries considerable risk potential if it is used for malicious purposes such as data exfiltration.

Cybercriminals or malware could exploit SSH tunnels to hide their unauthorized communications, or to exfiltrate stolen data from the target network. Once the attacker is in the target system, she connects to the outside SSH server from the inside.

Most organizations permit outgoing SSH connections, at least if they have servers in a public cloud. Setting up this SSH back-tunnel requires a single one-line command on the inside, and it can easily be automated. Most firewalls offer little to no protection against it. There are several widely known and documented cases of malware leveraging the SSH protocol as a means for hiding data exfiltration and command channels.

Several instances of malware have been actively collecting SSH keys. Captured and collected SSH keys have also been sold on hacker forums. SSH tunneling attacks can also be used for hiding the source of the attack. It is common or hackers to bounce attacks off systems and devices that allow SSH port forwarding to hide their tracks.

This allows them to probe for vulnerabilities, try various login credentials, or run attack tools against email, web, telephony and any other protocols. Bouncing an attack through a dozen random devices via encrypted tunnels also carrying other traffic makes it virtually untraceable.

Akamai documented millions of IoT devices being used in this way. Countering these risks requires the capability to monitor, control and audit encrypted SSH connections. For preventing bouncing, it requires proper configuration and hardening of IoT operating systems.

It should also be noted that tunneling attacks are not specific to SSH - a competent programmer can write a tool to tunnel ports in a few hours and can run it on any machine on the internal network. Any laptop or other device on the internal network can do it - it just needs to be able to communicate with some any service on the Internet.