These notes focus on the basics of ssh tunneling. For the concepts and the details of the technique you could read on LinuxFocus Bernard Perrot's paper Secure your connections with SSH or similar materials.
I will describe a ssh tunnel which uses only the command line. This is a safer technique and, under GNU/Linux, it gives you access to the full computing power of the system. However, one should be very careful with the ssh tunnel and take everything I write here on as-is-basis. The reader must bear the full responsability of her or his actions.
The best thing would be to work first with two locally-connected computers. Thus I assume that you work with computers disconnected from the Internet or placed behind a strict firewall.
In a rpm-based GNU/Linux distribution check if ssh is installed with the command:
rpm -q openssh
If you want to discover all the files which have "ssh" in their names try
locate ssh | less
However, a more restricted search like
locate "bin/ssh"
will give you information only about the executable programs, such as
/usr/sbin/sshd
/usr/bin/ssh
/usr/bin/ssh-keygen
In order to go through the tunnel in both directions you need a ssh server and a ssh client on both computers. A simple command like
ps aux | grep sshd
tells you if the ssh server is running or not. Actually, you look for a process which shows you that the ssh-deamon is running.
Practically, in order to go through the tunnel you must connect with a client from one computer to the server on the other computer. A simple way to call the ssh-client is
ssh snoopy@192.168.0.1
You write on the command line first the name of the ssh command and then an argument which looks like an e-mail address. Basically, you want to connect as snoopy on the computer with the IP 192.168.0.1 (I assume that you have given an IP to your computers, of course).
If this is the first connection, you get a message:
The authenticity of host '192.168.0.1 (192.168.0.1)' can't be established.
followed by
RSA key fingerprint is ...
and a question
Are you sure you want to continue connecting (yes/no)?
Answer "yes" if you are sure that everything is OK. Use
ssh -v snoopy@192.168.0.1
to know more about what is going on.
Read the manual of the ssh command with
man ssh
If everything is OK and you continue connecting, then the next question is
snoopy@192.168.0.1's password:
Send the password and that's it; you are connected. You can use now the command line as snoopy on the remote computer.
Sending the password each time is tedious and sometimes, when I use the two-panels Midnight Commander it might disturb the Text User Interface.
Read the manual of ssh-keygen and learn more about authentication key generation:
man ssh-keygen
Look for a ssh directory in your home:
ls -al ~ | grep ssh
You should get something according to this pattern
drwx------ 2 snoopy group 4096 Nov 29 10:08 .ssh
Pay attention to the permissions of this directory! You might be snoopy, but you do not want others to see the content of the directory. Create the directory if it does not exist.
Now you can generate keys for opening the ssh tunnel without typing each time the password.
ssh-keygen -t dsa
If you would like to understand what goes on read at least a general article about cryptography (see one on Wikipedia).
I just pressed Enter at all the questions. The resulting files should look according to this pattern:
-rw------- 1 snoopy group 1545 2007-11-29 12:14 id_dsa
-rw-r--r-- 1 snoopy group 336 2007-11-29 12:14 id_dsa.pub
The file id_dsa should remain a well-guarded secret. Do not show it to anybody.
The file id_dsa.pub, as the name suggests, is public. Change its name; you must know where it was created. For example, use the command
mv id_dsa.pub id_dsa-snoopy.pub
Then copy it to the other end of the ssh tunnel. At the other end of the tunnel put it into the .ssh directory. You may use the scp command (see its manual for details):
scp id_dsa-snoopy.pub snooky@192.168.0.2:.ssh/id_dsa-snoopy.pub
Then
cd ~/.ssh/
Check to see if you have in the .ssh directory a file called authorized_keys2. We use version 2 of ssh (see the readings for details). If there is no such file, create it
touch authorized_keys2
Change the permissions:
chmod go-r authorized_keys2
The rest of your group and other normal users must have no access to this file. Then
cat id_dsa-snoopy.pub >> authorized_keys2
will add the content from id_dsa-snoopy.pub to authorized_keys2. Remove the pub file
rm id_dsa-snoopy.pub
Repeat the operation for the other direction of the tunnel (if you need this, of course).
Before doing all this on the Internet, read as much as you can about security. Do not open ports that you do not use. Normally, the ssh-port is 22. From time to time check to see who is connecting through port 22. The number of the attempts to connect through 22 will surprize you.
You may want to see both ends of the ssh tunnel. Use mc for this. The mc has on the left and the right panel the possibility to connect through the ssh tunnel. Click Shell Link… and just write an expression which follows the pattern
snoopy@192.168.0.1
Of course, put your login name (not snoopy) and the IP of the machine at other end of the tunnel or its hostname (a name like foo.cub.net, when you have a working DNS).
Barrett, Silverman and Byrnes have a book on ssh and a web site of the book.
Dave Aaldering has posted a ssh-howto explaining how you generate the ssh-keys.