qmcgaw/ssh-socks-server repository overview

⁠ssh-socks-docker

Run a lightweight secured SSH SOCKS server with Docker

It is based on:

• Alpine 3.10⁠
• OpenSSH 8.0_p1-r0⁠

⁠Features

• No terminal login allowed
• Works with asymetric keypairs only, no password
• Only TCP forward tunneling on specific ports
• Chroot etc. to protect your host

⁠Setup

⁠On your server

1. Create a file users.conf with the format username,pubkey1,pubkey2,.... In example:

   quentin,ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2JEwHeumCS1IqhE9VVDFTtMVVVvumUdxuEi+ecdnSFFXS36TjeOD0BgI86tLReLQ3ExBJ+uG3NDCIoYrxF/bt42ZNEs627wcFZXUuEV/wgdY1IVrlW/7Wb95pl6eECggluzDUxrbrKF5kQPDlkEoAe86XQ/ZEnAB6EORmAQ4aXkIKoe56vndw6H1R+1nmFJfQ8vV8cBOEbHaN0CFOJUnqT3fo/7NRaFBiYJnqRSSBSzBWThc82VJ9QsDr8P+qUoSKaXrvShE/KCoFTNwu+oHqFeTdMUdaUXMRgbHbnNyXps3P7dCseDV3yyYhvvbEdPBy6Uo6oA76/aLTM4SV3l6R mykey
   user2,ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2JEwHeumCS1IqhE9VVDFTtMVVVvumUdxuEi+ecdnSFFXS36TjeOD0BgI86tLReLQ3ExBJ+uG3NDCIoYrxF/bt42ZNEs627wcFZXUuEV/wgdY1IVrlW/7Wb95pl6eECggluzDUxrbrKF5kQPDlkEoAe86XQ/ZEnAB6EORmAQ4aXkIKoe56vndw6H1R+1nmFJfQ8vV8cBOEbHaN0CFOJUnqT3fo/7NRaFBiYJnqRSSBSzBWThc82VJ9QsDr8P+qUoSKaXrvShE/KCoFTNwu+oHqFeTdMUdaUXMRgbHbnNyXps3P7dCseDV3yyYhvvbEdPBy6Uo6oA76/aLTM4SV3l6R userkey1
   

   Copy

2. Use the following command:

   docker run -d --name ssh-socks-server -p 8022:8022/tcp
   -v $(pwd)/users.conf:/users.conf:ro \
   -v /etc/ssh/ssh_host_rsa_key:/etc/ssh/ssh_host_rsa_key:ro \
   -v /etc/ssh/ssh_host_ecdsa_key:/etc/ssh/ssh_host_ecdsa_key:ro \
   -v /etc/ssh/ssh_host_ed25519_key:/etc/ssh/ssh_host_ed25519_key:ro \
   qmcgaw/ssh-socks-server
   

   Copy

   or use docker-compose.yml⁠ with:

   docker-compose up -d
   

   Copy

3. You should see the following with docker logs -f ssh-socks-server:

    =========================================
    =========================================
    ============ SSH SOCKS SERVER ===========
    =========================================
    =========================================
    == by github.com/qdm12 - Quentin McGaw ==
   
   Creating user quentin
   User quentin has public key 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2JEwHeumCS1IqhE9VVDFTtMVVVvumUdxuEi+ecdnSFFXS36TjeOD0BgI86tLReLQ3ExBJ+uG3NDCIoYrxF/bt42ZNEs627wcFZXUuEV/wgdY1IVrlW/7Wb95pl6eECggluzDUxrbrKF5kQPDlkEoAe86XQ/ZEnAB6EORmAQ4aXkIKoe56vndw6H1R+1nmFJfQ8vV8cBOEbHaN0CFOJUnqT3fo/7NRaFBiYJnqRSSBSzBWThc82VJ9QsDr8P+qUoSKaXrvShE/KCoFTNwu+oHqFeTdMUdaUXMRgbHbnNyXps3P7dCseDV3yyYhvvbEdPBy6Uo6oA76/aLTM4SV3l6R mykey'
   Server listening on 0.0.0.0 port 8022.
   Server listening on :: port 8022.
   

   Copy

⁠On your client

• If you have an SSH client installed:

  1. Enter

     ssh -D 8000 -N -p 8022 quentin@theserverIPorDomain
     

     Copy
     • 8022 is the TCP port to access the server container (depends on your router)
     • 8000 is the port on which the SOCKS proxy is (so localhost:8000)
     • quentin is the user to log in

  2. On the server side, you should see something similar to:

     Connection from 84.232.173.152 port 2604 on 172.17.0.2 port 8022
     Accepted key RSA SHA256:f8QzpBZ4kS3g1gInBiQoFKmyYGVWtIDjYj/2qoOzKJc found at /home/quentin/.ssh/authorized_keys:1
     Postponed publickey for quentin from 125.232.150.152 port 2604 ssh2 [preauth]
     Accepted key RSA SHA256:f8QzpBZ4kS3g1gInBiQoFKmyYGVWtIDjYj/2qoOzKJc found at /home/quentin/.ssh/authorized_keys:1
     Accepted publickey for quentin from 125.232.150.152 port 2604 ssh2: RSA SHA256:f8QzpBZ4kS3g1gInBiQoFKmyYGVWtIDjYj/2qoOzKJc
     User child is on pid 46
     Changed root directory to "/home/quentin"
     

     Copy

  3. On the client side, you should see something similar to:

     Welcome from your SSH SOCKS proxy!
     
     Enter passphrase for key '~/.ssh/id_rsa':
     
     

     Copy

• You can otherwise use the client Docker container qmcgaw/ssh-socks-client (in progress)

⁠Build it

docker build -t qmcgaw/ssh-socks-server https://github.com/qdm12/ssh-socks-server-docker.git

⁠TODOs

• Title
• SSH SOCKS client
• Allowed ports
• Firefox example
• Samba example
• Healthcheck
• Use cap_drop and cap_add
• /sbin/nologin

⁠License

This repository is under an MIT license⁠