SSH Tunneling - Revision history

Partsea at 04:07, 14 April 2008

2008-04-14T04:07:45Z

← Older revision		Revision as of 04:07, 14 April 2008
Line 4:		Line 4:
	== Components of a tunnel ==		== Components of a tunnel ==

-	[[Image:wiki img.jpg\|right\|~~500px~~\|thumb\|Tunneling Components]]	+	[[Image:wiki img.jpg\|right\|300px\|thumb\|Tunneling Components]]

	'''The Tunnel -''' The series of networks that the packet must travel to go from the starting network to the destination network.		'''The Tunnel -''' The series of networks that the packet must travel to go from the starting network to the destination network.

Partsea at 04:00, 14 April 2008

2008-04-14T04:00:58Z

← Older revision		Revision as of 04:00, 14 April 2008
Line 4:		Line 4:
	== Components of a tunnel ==		== Components of a tunnel ==

-	[[Image:wiki img.jpg\|right\|thumb\|Tunneling Components]]	+	[[Image:wiki img.jpg\|right\|500px\|thumb\|Tunneling Components]]

	'''The Tunnel -''' The series of networks that the packet must travel to go from the starting network to the destination network.		'''The Tunnel -''' The series of networks that the packet must travel to go from the starting network to the destination network.

Partsea at 03:29, 14 April 2008

2008-04-14T03:29:50Z

← Older revision		Revision as of 03:29, 14 April 2008
Line 1:		Line 1:
-	Tunneling refers to a packet, which is based on one protocol, being wrapped, or encapsulated, in a second packet that is based on another protocol. The encapsulating packet's protocol will be whatever differing protocol is needed in order for it to travel over an intermediary network. An SSH tunnel is an encrypted network tunnel created using an SSH connection. This type of tunnel allows you to transmit otherwise insecure TCP traffic in a secure fashion, as well as transfer packets with incompatible protocols over an intermediary network. When a tunneling protocol uses data encryption (SSH) to transport packets that are based on insecure protocols over the Internet, they are in essence providing VPN functionality.	+	Tunneling refers to a packet, which is based on one protocol, being wrapped, or encapsulated, in a second packet that is based on another protocol. The encapsulating packet's protocol will be whatever differing protocol is needed in order for it to travel over an intermediary network. An SSH tunnel is an encrypted network tunnel created using an SSH connection. This type of tunnel allows you to transmit otherwise insecure TCP traffic in a secure fashion, as well as transfer packets with incompatible protocols over an intermediary network. When a tunneling protocol uses data encryption (SSH) to transport packets that are based on insecure protocols over the Internet, they are in essence providing VPN functionality. In real-life terms, tunneling is comparable to "encapsulating" a present (the original packet) in a box (the capsule) for delivery through the postal system.
		+

	== Components of a tunnel ==		== Components of a tunnel ==
Line 7:		Line 8:
	'''The Tunnel -''' The series of networks that the packet must travel to go from the starting network to the destination network.		'''The Tunnel -''' The series of networks that the packet must travel to go from the starting network to the destination network.

-	'''Tunnel Interfaces -''' These are the points where the starting and destination networks ~~comes~~ into contact with the tunnel.	+	'''Tunnel Interfaces -''' These are the points where the starting and destination networks come into contact with the tunnel.

	'''Passenger Protocol -''' This is the original data being transferred that may be either insecure or incompatible with the carrier protocol.		'''Passenger Protocol -''' This is the original data being transferred that may be either insecure or incompatible with the carrier protocol.

-	'''Encapsulating Protocol -''' This is the protocol that is wrapped around the original passenger protocol. This protocol must be understood by both tunnel interfaces and commonly come in the form of GRE, IPSec, L2F, PPTP & L2TP.	+	'''Encapsulating Protocol -''' This is the protocol that is wrapped around the original passenger protocol. This protocol must be understood by both tunnel interfaces and commonly come in the form of GRE, IPSec, L2F, PPTP & L2TP.\\

	'''Carrier Protocol -''' This is the protocol use by the network that the encapsulated package is travelling over.		'''Carrier Protocol -''' This is the protocol use by the network that the encapsulated package is travelling over.
Line 17:		Line 18:
	== The Tunneling Process ==		== The Tunneling Process ==

-	In ~~tunneling~~, ~~a packet based~~ on ~~one protocol~~ is ~~wrapped~~, ~~or encapsulated~~, ~~in a second packet based~~ on ~~whatever differing protocol is needed in order for it~~ to ~~travel over an intermediary network~~. ~~In effect~~, the ~~second wrapper "insulates"~~ the ~~original packet and creates~~ the ~~illusion of~~ a ~~tunnel through which~~ the ~~wrapped packet travels across~~ the ~~intermediary network~~. ~~In real-life terms~~, ~~tunneling is comparable~~ to ~~"encapsulating" a present~~ (the ~~original packet~~) in ~~a box~~ (the ~~secondary wrapper~~) ~~for delivery through~~ the ~~postal system~~.	+	In this example, we will create secure connection using SSH and local port fowarding.
		+
		+	1) First you launch the SSH client on the command line.
		+
		+	2) Use the SSH client to log into the remote machine using whatever authentication method is available, such as password, Pubkey, etc.
		+
		+	3) The SSH client binds the local port you specified, on the loopback interface, 127.0.0.1.
		+
		+	4) When a process connects to 127.0.0.1 on the the client machine on the port you specified, SSH client program accepts the conection.
		+
		+	5) The SSH client informs the server, over the encrypted channel, to create a connection to the destination, such as a mailserver shown in the example below.
		+
		+	6) The client takes any bits sent to the port you specified on your machine and sends them to the server inside the encrypted SSH session, who decrypts them and then sends them in the clear to the destination (the mailserver).
		+	The server takes any bits received from the mailserver and sends them inside the SSH session back to the client, who decrypts and sends them in the clear to the process that connected to the client's bound port (the port you intially specified).
		+
		+	7) When the connection is closed by either endpoint, it is torn down inside the SSH session as well.

	== Application ==		== Application ==
Line 25:		Line 41:
	To avoid this, instead of connecting directly, establish an SSH connection to the network of which the mail server is a part of. The SSH client software sets up a port forwarding mechanism, making the traffic heading to your home computer's POP be forwarded over the encrypted tunnel and end up at the mail server's POP port. You then direct your email client to your local POP port and it thinks that it is talking to the remote end, only this time, the entire session is encrypted. Anyone trying to listen in on the conversation between your home computer and work machine, will hear something resembling noise.		To avoid this, instead of connecting directly, establish an SSH connection to the network of which the mail server is a part of. The SSH client software sets up a port forwarding mechanism, making the traffic heading to your home computer's POP be forwarded over the encrypted tunnel and end up at the mail server's POP port. You then direct your email client to your local POP port and it thinks that it is talking to the remote end, only this time, the entire session is encrypted. Anyone trying to listen in on the conversation between your home computer and work machine, will hear something resembling noise.

-	To set this up, you'll need an SSH client capable of tunneling. OpenSSH is a free open source version of SSH connectivity tools. Under Windows, you'll need a client like SecureCRT, which is commercial software. Cygwin is a linux like environment for Windows that contains an SSH package.	+	To set this up, all you'll need an SSH client capable of tunneling. OpenSSH is a free open source version of SSH connectivity tools. Under Windows, you'll need a client like SecureCRT, which is commercial software. Cygwin is a linux like environment for Windows that contains an SSH package.


Line 41:		Line 57:

	2) [http://computer.howstuffworks.com/vpn13.htm How Virtual Private Networks Work]		2) [http://computer.howstuffworks.com/vpn13.htm How Virtual Private Networks Work]
		+
		+	3) [http://3sp.com/kb/idx/73/203/article/What_is_Tunneling.html What is Tunneling?]

	== External links ==		== External links ==

Partsea at 02:59, 14 April 2008

2008-04-14T02:59:20Z

← Older revision		Revision as of 02:59, 14 April 2008
Line 32:		Line 32:
	[[Applications of SSH]]		[[Applications of SSH]]

-	[[Virtual Private Networks ~~(VPNs)~~ ]]	+	[[Virtual Private Networks ]]

	[[The Future of the Internet: IPv6]]		[[The Future of the Internet: IPv6]]

Partsea at 02:49, 14 April 2008

2008-04-14T02:49:26Z

← Older revision		Revision as of 02:49, 14 April 2008
Line 27:		Line 27:
	To set this up, you'll need an SSH client capable of tunneling. OpenSSH is a free open source version of SSH connectivity tools. Under Windows, you'll need a client like SecureCRT, which is commercial software. Cygwin is a linux like environment for Windows that contains an SSH package.		To set this up, you'll need an SSH client capable of tunneling. OpenSSH is a free open source version of SSH connectivity tools. Under Windows, you'll need a client like SecureCRT, which is commercial software. Cygwin is a linux like environment for Windows that contains an SSH package.

-
-	~~== Refrences ==~~
-
-	~~[http://www.ssh.com/support/documentation/online/ssh/winhelp/32/Tunneling_Explained.html/ SSH Tunneling Explained]~~
-
-	~~[http://3sp.com/kb/idx/73/203/article/What_is_Tunneling.html What is Tunneling?]~~

	== See Also ==		== See Also ==

-	~~== External links ==~~	+	[[Applications of SSH]]
-	[~~http://www.openssh.org/ OpenSSH~~]	+

-	[~~http://www.vandyke.com/products/securecrt/ SecureCRT]~~	+	[[Virtual Private Networks (VPNs) ]]
-		+
-	[~~http://cygwin.com/ Cygwin~~]	+

		+	[[The Future of the Internet: IPv6]]

		+	== Refrences ==

		+	1) [http://www.ssh.com/support/documentation/online/ssh/winhelp/32/Tunneling_Explained.html/ SSH Tunneling Explained]

		+	2) [http://computer.howstuffworks.com/vpn13.htm How Virtual Private Networks Work]

		+	== External links ==
		+	[http://www.openssh.org/ OpenSSH Main Page]

		+	[http://www.vandyke.com/products/securecrt/ SecureCRT Main Page]

		+	[http://cygwin.com/ Cygwin Main Page]


	--[[User:Partsea\|Partsea]] 22:31, 13 April 2008 (EDT)		--[[User:Partsea\|Partsea]] 22:31, 13 April 2008 (EDT)

Partsea at 02:32, 14 April 2008

2008-04-14T02:32:13Z

← Older revision		Revision as of 02:32, 14 April 2008
Line 31:		Line 31:

	[http://www.ssh.com/support/documentation/online/ssh/winhelp/32/Tunneling_Explained.html/ SSH Tunneling Explained]		[http://www.ssh.com/support/documentation/online/ssh/winhelp/32/Tunneling_Explained.html/ SSH Tunneling Explained]
-	[http://3sp.com/kb/idx/73/203/article/What_is_Tunneling.html What is Tunneling]	+
		+	[http://3sp.com/kb/idx/73/203/article/What_is_Tunneling.html What is Tunneling?]

	== See Also ==		== See Also ==

Partsea at 02:31, 14 April 2008

2008-04-14T02:31:56Z

← Older revision		Revision as of 02:31, 14 April 2008
Line 31:		Line 31:

	[http://www.ssh.com/support/documentation/online/ssh/winhelp/32/Tunneling_Explained.html/ SSH Tunneling Explained]		[http://www.ssh.com/support/documentation/online/ssh/winhelp/32/Tunneling_Explained.html/ SSH Tunneling Explained]
-	[http://3sp.com/kb/idx/73/203/article/What_is_Tunneling.html What is Tunneling?]	+	[http://3sp.com/kb/idx/73/203/article/What_is_Tunneling.html What is Tunneling]

	== See Also ==		== See Also ==

Partsea at 02:31, 14 April 2008

2008-04-14T02:31:23Z

← Older revision		Revision as of 02:31, 14 April 2008
Line 21:		Line 21:
	== Application ==		== Application ==

-	A typical use would be to securely retrieve e-mail from work, while ~~sitting~~ at home, using a POP client. By connecting to the machine directly, you would be sending your login and password in the open and risk having them stolen to be subsequently used to gain access to confidential information.	+	A typical use would be to securely retrieve e-mail from work, while at home & using a POP client. By connecting to the machine directly, you would be sending your login and password in the open and risk having them stolen to be subsequently used to gain access to confidential information.

	To avoid this, instead of connecting directly, establish an SSH connection to the network of which the mail server is a part of. The SSH client software sets up a port forwarding mechanism, making the traffic heading to your home computer's POP be forwarded over the encrypted tunnel and end up at the mail server's POP port. You then direct your email client to your local POP port and it thinks that it is talking to the remote end, only this time, the entire session is encrypted. Anyone trying to listen in on the conversation between your home computer and work machine, will hear something resembling noise.		To avoid this, instead of connecting directly, establish an SSH connection to the network of which the mail server is a part of. The SSH client software sets up a port forwarding mechanism, making the traffic heading to your home computer's POP be forwarded over the encrypted tunnel and end up at the mail server's POP port. You then direct your email client to your local POP port and it thinks that it is talking to the remote end, only this time, the entire session is encrypted. Anyone trying to listen in on the conversation between your home computer and work machine, will hear something resembling noise.

-	To set this up, you'll need an SSH client capable of tunneling. OpenSSH is a free open source version of SSH connectivity tools. Under Windows, you'll need a client like SecureCRT, which is commercial software. Cygwin is linux like environment for Windows that contains an SSH package.	+	To set this up, you'll need an SSH client capable of tunneling. OpenSSH is a free open source version of SSH connectivity tools. Under Windows, you'll need a client like SecureCRT, which is commercial software. Cygwin is a linux like environment for Windows that contains an SSH package.


	== Refrences ==		== Refrences ==
		+
		+	[http://www.ssh.com/support/documentation/online/ssh/winhelp/32/Tunneling_Explained.html/ SSH Tunneling Explained]
		+	[http://3sp.com/kb/idx/73/203/article/What_is_Tunneling.html What is Tunneling?]

	== See Also ==		== See Also ==

	== External links ==		== External links ==
		+	[http://www.openssh.org/ OpenSSH]
		+
		+	[http://www.vandyke.com/products/securecrt/ SecureCRT]
		+
		+	[http://cygwin.com/ Cygwin]
		+
		+
		+
		+
		+
		+
		+
		+

-	--[[User:Partsea\|Partsea]] 07:16, 9 April 2008 (EDT)	+	--[[User:Partsea\|Partsea]] 22:31, 13 April 2008 (EDT)

24.141.142.43 at 01:24, 14 April 2008

2008-04-14T01:24:57Z

← Older revision		Revision as of 01:24, 14 April 2008
Line 9:		Line 9:
	'''Tunnel Interfaces -''' These are the points where the starting and destination networks comes into contact with the tunnel.		'''Tunnel Interfaces -''' These are the points where the starting and destination networks comes into contact with the tunnel.

		+	'''Passenger Protocol -''' This is the original data being transferred that may be either insecure or incompatible with the carrier protocol.

		+	'''Encapsulating Protocol -''' This is the protocol that is wrapped around the original passenger protocol. This protocol must be understood by both tunnel interfaces and commonly come in the form of GRE, IPSec, L2F, PPTP & L2TP.
		+
		+	'''Carrier Protocol -''' This is the protocol use by the network that the encapsulated package is travelling over.

	== The Tunneling Process ==		== The Tunneling Process ==
-
-

	In tunneling, a packet based on one protocol is wrapped, or encapsulated, in a second packet based on whatever differing protocol is needed in order for it to travel over an intermediary network. In effect, the second wrapper "insulates" the original packet and creates the illusion of a tunnel through which the wrapped packet travels across the intermediary network. In real-life terms, tunneling is comparable to "encapsulating" a present (the original packet) in a box (the secondary wrapper) for delivery through the postal system.		In tunneling, a packet based on one protocol is wrapped, or encapsulated, in a second packet based on whatever differing protocol is needed in order for it to travel over an intermediary network. In effect, the second wrapper "insulates" the original packet and creates the illusion of a tunnel through which the wrapped packet travels across the intermediary network. In real-life terms, tunneling is comparable to "encapsulating" a present (the original packet) in a box (the secondary wrapper) for delivery through the postal system.
-

	== Application ==		== Application ==

24.141.142.43 at 21:18, 13 April 2008

2008-04-13T21:18:20Z

← Older revision		Revision as of 21:18, 13 April 2008
Line 24:		Line 24:
	To avoid this, instead of connecting directly, establish an SSH connection to the network of which the mail server is a part of. The SSH client software sets up a port forwarding mechanism, making the traffic heading to your home computer's POP be forwarded over the encrypted tunnel and end up at the mail server's POP port. You then direct your email client to your local POP port and it thinks that it is talking to the remote end, only this time, the entire session is encrypted. Anyone trying to listen in on the conversation between your home computer and work machine, will hear something resembling noise.		To avoid this, instead of connecting directly, establish an SSH connection to the network of which the mail server is a part of. The SSH client software sets up a port forwarding mechanism, making the traffic heading to your home computer's POP be forwarded over the encrypted tunnel and end up at the mail server's POP port. You then direct your email client to your local POP port and it thinks that it is talking to the remote end, only this time, the entire session is encrypted. Anyone trying to listen in on the conversation between your home computer and work machine, will hear something resembling noise.

-	~~== Implications??? ==~~	+	To set this up, you'll need an SSH client capable of tunneling. OpenSSH is a free open source version of SSH connectivity tools. Under Windows, you'll need a client like SecureCRT, which is commercial software. Cygwin is linux like environment for Windows that contains an SSH package.

-	~~== History? ==~~

	== Refrences ==		== Refrences ==