Wireless Hacks

Forwarding Ports over SSH

Keep network traffic to arbitrary ports secure with SSH port forwarding.

In addition to providing remote shell access and command execution, OpenSSH can also forward arbitrary TCP ports to the other end of your connection. This can be extremely handy for protecting email, web, or any other traffic that you need to keep private (at least, all the way to the other end of the tunnel).

SSH accomplishes local forwarding by binding to a local port, performing encryption, sending the encrypted data to the remote end of the SSH connection, then decrypting it and sending it to the remote host and port you specify. Start an SSH tunnel with the -L switch (short for Local):

root@laptop:~# ssh -f -N -L110:
            mailhost
            :110 -l user mailhost

Naturally, substitute user with your username, and mailhost with your mail server’s name or IP address. Note that you will have to be root on laptop for this example, since you’ll be binding to a privileged port (110, the POP port). You should also disable any locally running POP daemon (look in /etc/inetd.conf) or it will get in the way.

Now to encrypt all of your POP traffic, configure your mail client to connect to localhost port 110. It will happily talk to mailhost as if it were connected directly, except that the entire conversation will be encrypted.

The -f forks SSH into the background, and -N tells it not to actually run a command on the remote end (just do the forwarding). If your SSH server supports it, try the -C switch ...