ays57/ssh-tunnels-server repository overview

⁠ays57/ssh-tunnels-server

Hardened, lightweight (~18MB) Alpine Linux-based SSH tunnel server designed exclusively for secure port-forwarding bastions into clusters and private networks.

⁠Features

• Zero-Shell Security: Interactive shells and command execution are completely blocked (nologin-tunnel).
• Safe Tunnel Holding: Connect with or without -N — holding sessions open cleanly until disconnected.
• Strict Port Forwarding: Local (-L) and Dynamic SOCKS (-D) forwarding only; reverse forwarding (-R) is disabled.
• Destination Whitelisting: Restrict access to specific targets using SSH_PERMIT_OPEN.
• High Performance: Optimized for maximum throughput and low latency (IPv4-first, no CS1 scavenger packet tagging, hardware AES-GCM acceleration).
• Multi-Arch: Supports linux/amd64 and linux/arm64.

⁠Quick Start

⁠1. Run with Docker CLI

docker run -d \
  --name ssh-tunnel \
  --restart unless-stopped \
  -p 2222:2222 \
  -e ALLOWED_IPS="AllowUsers tunnel@*" \
  -e AUTHORIZED_KEYS="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5... user@client" \
  ays57/ssh-tunnels-server:latest

⁠2. Run with Docker Compose

services:
  ssh-tunnel:
    image: ays57/ssh-tunnels-server:latest
    container_name: ssh-tunnel
    restart: unless-stopped
    ports:
      - "2222:2222"
    environment:
      - ALLOWED_IPS=AllowUsers tunnel@*
      - AUTHORIZED_KEYS=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5... user@client
      - SSH_PERMIT_OPEN=database:3306 redis:6379   # Optional: limit tunnel targets
    volumes:
      - ./ssh_host_keys:/etc/ssh/ssh_host_keys     # Optional: persist host keys

⁠Connecting & Creating Tunnels

⁠Local Port Forwarding (-L)

Forward local port 3306 through the tunnel to internal service database:3306:

ssh -p 2222 -L 3306:database:3306 tunnel@<server-ip>

(Optionally append -N to skip holding session output)

⁠Dynamic SOCKS5 Proxy (-D)

Route browser or tool traffic through your private network:

ssh -p 2222 -D 1080 tunnel@<server-ip>

⁠Environment Variables

* Alternatively, mount your keys to /authorized_keys or /home/tunnel/.ssh/authorized_keys.

⁠Source & Documentation

For complete documentation, security benchmarks, and advanced configuration, visit the GitHub Repository⁠.