[{"_1":2,"_169":-5,"_170":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_144":145},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":17},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_84":-5,"_85":86,"_135":-5,"_136":11,"_137":17,"_138":11,"_139":-5,"_140":11,"_141":-5,"_142":143},"canonicalUrl","https://hub.docker.com/r/cablethief/sshaft/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","cablethief","reponame","sshaft","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":70,"_75":11,"_76":77,"_81":29,"_82":83},"categories",[],"content_types",[40],"image","date_registered","2019-05-22T10:55:40.364198Z","description","Docker sshd server to facilitate ssh tunneling.","is_private","last_updated","2021-10-06T11:40:59.270806Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[52],"application/vnd.docker.container.image.v1+json","name","pull_count",664,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# SSHaft\n\nA quick [sshd](https://www.openssh.com/) server for reverse tunneling.\n\nAlso available on Dockerhub:\nhttps://hub.docker.com/r/cablethief/sshaft\n\n## Overview\n\nSometimes for whatever reason it is convenient to have a sshd server quickly available to do tunneling to get between networks etc. This docker image provides a way to create a low privilege user and allow port forwarding.\n\n## Features\n\n - Can set the port sshd listens on.\n - Can setup a low privilege user.\n - Can use root if wanted. \n - Allows for use of docker port binding by default (Disables IPv6). \n - Attempts to restrict users to only port forwarding by default. \n\n## Running\n\nThere are two ways to easily run this using standard docker. One is to create a compose file which may be used multiple times and the other is a one liner using normal docker. \n\nThe typical docker line would be:\n\n```\n# Run and view output, exit with Ctrl+c, this will create a user \"testing\" with password \"testing\" \n# as well as expose ports 22 and 4444\nsudo docker run --rm -it -e \"USERNAME=testing\" -e \"PASSWORD=testing\" -p 22:22 -p 4444:4444 cablethief/sshaft:latest\n# If you do not want to bother with exposing ports you may use your hosts adapter\nsudo docker run --rm -it -e \"USERNAME=testing\" -e \"PASSWORD=testing\" --network host cablethief/sshaft:latest\n```\n\nAnd using the provided compose file:\n\n```\n# This will create and run the container using the variables specified within the file.\nsudo docker-compose --file compose.yml up\n```\n\n## Environment Variables\n\nSome variables have been provided to allow for customization of the created sshd server. \n\nCreate a lower privileged user, there is no default password so both variables have to be set. \n```\nUSERNAME=testing \nPASSWORD=testing \n```\n\nUse the root user and set the password, this allows for binding to lower ports. \n```\nROOT_PASSWORD=Testing\n```\n\nSet the sshd server port incase you want something other than 22\n```\nSSH_PORT=12122\n```\n\nBy default the container will not allow you to get a shell via SSH, you may change this behavior. \n\n_Without the `ENABLE_SHELL=true` environment variable set SSH clients should use the `-N` flag to not request a shell_\n\n```\nENABLE_SHELL=true\n```\n\nDocker does not use IPv6 without starting the daemon with [special flags](https://docs.docker.com/v17.09/engine/userguide/networking/default_network/ipv6/#how-ipv6-works-on-docker), incase you have those flags you may enable IPv6 in sshd.\n```\nENABLE_IPV6=true\n```\n\n## IPv6 Nonsense \n\nDocker [disables ipv6](https://docs.docker.com/v17.09/engine/userguide/networking/default_network/ipv6/) by default and this makes sshd upset which prevented forwarding without `network_mode host`. By disabling ipv6 in sshd this problem is fixed, a environment flag (`ENABLE_IPV6=true`) is provided to disable this behavior however [further flags](https://docs.docker.com/v17.09/engine/userguide/networking/default_network/ipv6/#how-ipv6-works-on-docker) need to be set when starting the docker daemon.\n\n\n## SSH Port Forwarding Basics\n\nIn general SSH provides 3 ways to port forward through a tunnel. \n\n_Without the `ENABLE_SHELL=true` environment variable set SSH clients should use the `-N` flag to not request a shell_\n\n**Dynamic port forwarding** using `-D `, this creates a socks proxy on the ssh client which will tunnel traffic through to the sshd server. This will allow the client access to whatever the server can access over the network.\n\n**Local port forwarding** using `-L []:::`. Will take traffic entered into the `[]` on the ssh client and pass it through the tunnel to a server reachable by the sshd server `:`.\n\n**Remote port forwarding** using `-R []:::`. Will take traffic sent to the sshd servers `[]:` and pass it through the tunnel to a server reachable by the client `:`. \n\nRemote port forwarding is the most likely use for this image. You wish to use a tool like [plink.exe](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html) from a dual NATed/whitelisted host to gain access to a second network from a restrictive shell.\n\nFor example to reach a remote hosts port 445 which is only accessible from a certain host the following will forward port 445 on the containers (your) sshd server and traffic entered there will reach the remote server 10.1.1.12:445 through the host running plink.exe:\n\n```\n# Need echo y to bypass changed hostkey check\nC:\\ cmd.exe /c echo y | .\\plink.exe -N -pw testing root@ -R 445:10.1.1.12:445\n```\n\n## Future work\n\n - Add [rpivot](https://github.com/klsecservices/rpivot) and environment flags to enable it for reverse dynamic port forwards. \n - Maybe add a honey pot flag to view passwords tried against the server.\n\n## Compose file example\n\n```yaml\nversion: '3'\n\nservices:\n sshaft:\n image: cablethief/sshaft\n container_name: sshaft\n # If you are lazy and don't know what ports you want to forward at the moment.\n # network_mode: host\n ports:\n # Always give sub 60 port mappings as strings \"https://docs.docker.com/compose/compose-file/\"\n - \"22:22\"\n - \"4444:4444\"\n environment:\n - USERNAME=testing \n - PASSWORD=testing \n # - ROOT_PASSWORD=Testing \n # - SSH_PORT=22\n # Without the `ENABLE_SHELL=true` environment variable set SSH clients should use the `-N` flag to not request a shell\n # - ENABLE_SHELL=true\n # Ensure you start your docker daemon with the --ipv6 and maybe --fixed-cidr-v6\n # https://docs.docker.com/v17.09/engine/userguide/networking/default_network/ipv6/#how-ipv6-works-on-docker\n # - ENABLE_IPV6=true\n```\n","has_starred","hub_user","immutable_tags_settings",{"_71":11,"_72":73},"enabled","rules",[74],".*","is_automated","permissions",{"_78":17,"_79":11,"_80":11},"read","write","admin","user","storage_size",40709860,"orgData","recentTags",[87,125],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":96,"_46":114,"_115":90,"_116":29,"_117":52,"_53":118,"_119":120,"_121":105,"_122":114,"_123":62,"_124":17},"content_type","creator",6431420,"full_size",5064468,"id",56487553,"images",[97],{"_98":99,"_100":101,"_102":103,"_104":105,"_106":107,"_108":109,"_110":103,"_111":-5,"_112":92,"_59":62,"_113":-5},"architecture","amd64","digest","sha256:ac63025d21464ecc12c96b952994e838a489f649ce5c2b48210a33945b619417","features","","last_pulled","2026-09-26T07:56:33.319300595Z","last_pushed","2021-10-06T11:40:59Z","os","linux","os_features","os_version","size","variant","2021-10-06T11:40:58.975909Z","last_updater","last_updater_username","media_type","latest","repository",7155623,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_88":40,"_89":90,"_91":126,"_93":127,"_95":128,"_46":133,"_115":90,"_116":29,"_117":52,"_53":134,"_119":120,"_121":131,"_122":133,"_123":62,"_124":17},5114509,69521333,[129],{"_98":99,"_100":130,"_102":103,"_104":131,"_106":132,"_108":109,"_110":103,"_111":-5,"_112":126,"_59":62,"_113":-5},"sha256:c9bb0c579eb440974b79cb549b96786e0f7a3b5a0ac000598480b9a393a28dc7","2026-09-26T07:52:59.100813952Z","2019-09-27T10:58:49Z","2019-09-27T10:58:48.300289Z","testing","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":146,"_153":154,"_142":167,"_168":11},{"_36":147,"_38":148,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":149,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":150,"_75":11,"_76":152,"_81":29,"_82":83},[],[40],[52],{"_71":11,"_72":151},[74],{"_78":17,"_79":11,"_80":11},"tags",{"_155":156,"_157":-5,"_158":-5,"_159":160},"count",2,"next","previous","results",[161,164],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":162,"_46":114,"_115":90,"_116":29,"_117":52,"_53":118,"_119":120,"_121":105,"_122":114,"_123":62,"_124":17},[163],{"_98":99,"_100":101,"_102":103,"_104":105,"_106":107,"_108":109,"_110":103,"_111":-5,"_112":92,"_59":62,"_113":-5},{"_88":40,"_89":90,"_91":126,"_93":127,"_95":165,"_46":133,"_115":90,"_116":29,"_117":52,"_53":134,"_119":120,"_121":131,"_122":133,"_123":62,"_124":17},[166],{"_98":99,"_100":130,"_102":103,"_104":131,"_106":132,"_108":109,"_110":103,"_111":-5,"_112":126,"_59":62,"_113":-5},[],"canDeleteTags","actionData","errors"]

cablethief/sshaft

Tags for cablethief/sshaft