Re:What's the problem that SSH tunneling is trying to solve?
by kazinator on Monday July 10, 2023 @05:00AM
(#36663729)
Not enough information here, but I think it falls into roughly these possibilities:
1. The tunnels are required by IT. For certain machines, they wanted an extra layer of security.
2. The tunnels are rogue. By "we need to do tunneling" it means "without knowledge/approval of IT, we hacked access to something via SSH tunnels".
Either way:
> Can't anyone who knows the server IP and has company VPN; tunnel and get access to that server?
Not necessarily! Internal IP addresses can be divided into subnets with firewalls between them, such that the only way to get through is SSH tunnels (or other chosen means).
Even if you're physically inside the company, on the LAN, and not coming in via a VPN, you may have to use a tunnel to get to certain resources.
You can set up something like that at your own desk! Put a router on the LAN, where behind your router you have your 192.168.0/* network. On your router, you can have an sshd server, and then so from outside of your little desktop network, you can SSH to your company-LAN-facing machine (say 10.x.y.z) and set up a tunnel targeting some 192.168.0.n:nnnn address in your desktop network.
The point of doing this would be that you cannot just route between the company LAN and your 192.168 subnet. You could do port forwarding. But ssh tunnels give you more flexibility than a fixed port forwarding configuration. The ssh client can specify tunnels. And ssh keeps out unauthorized users. Nobody can access anything in your 196.168.0/* without ssh access to the 10.x.y.z router. And ssh can help get around blocked ports.
1. The tunnels are required by IT. For certain machines, they wanted an extra layer of security.
2. The tunnels are rogue. By "we need to do tunneling" it means "without knowledge/approval of IT, we hacked access to something via SSH tunnels".
Either way:
> Can't anyone who knows the server IP and has company VPN; tunnel and get access to that server?
Not necessarily! Internal IP addresses can be divided into subnets with firewalls between them, such that the only way to get through is SSH tunnels (or other chosen means).
Even if you're physically inside the company, on the LAN, and not coming in via a VPN, you may have to use a tunnel to get to certain resources.
You can set up something like that at your own desk! Put a router on the LAN, where behind your router you have your 192.168.0/* network. On your router, you can have an sshd server, and then so from outside of your little desktop network, you can SSH to your company-LAN-facing machine (say 10.x.y.z) and set up a tunnel targeting some 192.168.0.n:nnnn address in your desktop network.
The point of doing this would be that you cannot just route between the company LAN and your 192.168 subnet. You could do port forwarding. But ssh tunnels give you more flexibility than a fixed port forwarding configuration. The ssh client can specify tunnels. And ssh keeps out unauthorized users. Nobody can access anything in your 196.168.0/* without ssh access to the 10.x.y.z router. And ssh can help get around blocked ports.