anderspitman / sirtunnel Goto Github PK

Minimal, self-hosted, 0-config alternative to ngrok. Caddy+OpenSSH+50 lines of Python.

License: MIT License

Shell 32.57% Python 67.43%

sirtunnel's Introduction

What is it?

If you have a webserver running on one computer (say your development laptop), and you want to expose it securely (ie HTTPS) via a public URL, SirTunnel allows you to easily do that.

How do you use it?

If you have:

A SirTunnel server instance listening on port 443 of example.com.
A copy of the sirtunnel.py script available on the PATH of the server.
An SSH server running on port 22 of example.com.
A webserver running on port 8080 of your laptop.

And you run the following command on your laptop:

ssh -tR 9001:localhost:8080 example.com sirtunnel.py sub1.example.com 9001

Now any requests to https://sub1.example.com will be proxied to your local webserver.

How does it work?

The command above does 2 things:

It starts a standard remote SSH tunnel from the server port 9001 to local port 8080.
It runs the command sirtunnel.py sub1.example.com 9001 on the server. The python script parses sub1.example.com 9001 and uses the Caddy API to reverse proxy sub1.example.com to port 9001 on the server. Caddy automatically retrieves an HTTPS cert for sub1.example.com.

Note: The -t is necessary so that doing CTRL-C on your laptop stops the sirtunnel.py command on the server, which allows it to clean up the tunnel on Caddy. Otherwise it would leave sirtunnel.py running and just kill your SSH tunnel locally.

How is it different?

There are a lot of solutions to this problem. In fact, I've made something of a hobby of maintaining a list of the ones I've found so far.

The main advantages of SirTunnel are:

Minimal. It leverages Caddy and whatever SSH server you already have running on your server. Other than that, it consists of a 50-line Python script on the server. That's it. Any time you spend learning to customize and configure it will be time well spent because you're learning Caddy and your SSH server.
0-configuration. There is no configuration on the server side. Not even CLI arguments.
Essentially stateless. The only state is the certs (which is handled entirely by Caddy) and the tunnel mappings, which are ephemeral and controlled by the clients.
Automatic HTTPS certificate management. Some other solutions do this as well, so it's important but not unique.
No special client is required. You can use any standard SSH client that supports remote tunnels. Again, this is not a unique feature.

Running the server

Assuming you already have an ssh server running, getting the SirTunnel server going consists of simply downloading a copy of Caddy and running it with the provided config. Take a look at install.sh and run_server.sh for details.

Note: Caddy needs to bind to port 443, either by running as root (not recommended), setting the CAP_NET_BIND_SERVICE capability on the Caddy binary (what the install.sh script does), or changing caddy_config.json to bind to a different port (say 9000) and using something like iptables to forward to that port.

Future Features

SirTunnel is intended to be a minimal tool. As such, I'm unlikely to add many features moving forward. However, the simplicity makes it easier to modify for your needs. For example, see this fork which adds functionality to help multiple users avoid overwriting each others' tunnels:

https://github.com/matiboy/SirTunnel

sirtunnel's People

Contributors

Stargazers

Watchers

Forkers

johnthethird sdllabs matiboy cultivateinc patrick-mota dkarter ajju2211 uzbekdev1 dmi3mis suryatmodulus rahulshinde11 shantanunair mciverza airgapper druuu liscombc akhil-hari hermesthecat bidochko onur-gokce tonyfg argonauta666 swifilaboroka trbouma sobirjonovs mszb ramkrishna70 mrmushfiq t3chguy 0xo0o0 bparanj liamdgray ziasistani kumareshr spansky yanbo92 ahmadalwa anhvu0510 maheskrishnan lcsouzamenezes occoder raaghulr canaanmckenzie acrolink dlwocks31 rahulvramesh daynil zarumaru systemsthinkinginstitute tonyg ancherhisogi m8e matijs 0xack13 dadav abhicoolboy96 abdulkereem tosunkaya mestrelion nikosch86 willjeynes huskyhunk daps94 apersonintech voldemort373 mecasual19 secdev02 imcgaunn thinkst-cs jony1993 sjbat supermarpig avaudioplayer snryid vincegao09 ketaice tuot huaishui ypgaolele goroddetstva willingsasi nnuujj guodunwang naka1205 lssoftware sakishum xixiaohe haha003 cy920820 charlie1227 jingmian fhyfhytt

sirtunnel's Issues

Detect and use correct arch in install.sh

Install script shouldn't deploy an x86 binary of Caddy to ARM devices (for example).

Server setup - digital ocean example

I'm hoping to run the server on a Digital Ocean droplet. Is the following a good plan?

Create a new droplet (let's assume I use my SSH key instead of password-based)
Create a dedicated sirtunnel user so I'm not running as root
Create an SSH keypair id_sirtunnel for this new user. The private key is what will be used by users/clients
Clone SirTunnel to the droplet, run the install.sh and then run_server.sh
Register a dedicated domain for this (let's say rarkinstunnel.com)
Configure a wildcard DNS entry for rarkinstunnel.com pointing to my droplet IP
ssh -i ~/.ssh/id_sirtunnel -tR 9001:localhost:8080 rarkinstunnel.com sirtunnel.py sub1.rarkinstunnel.com 9001

Is that enough, including for Caddy to somehow fetch certs from LetsEncrypt for rarkinstunnel.com?

BTW I'm not sure I understand the 9001 port, which I've copied directly from your example. Does that need to be unique for each different user/tunnel I wish to run?

forward tcp traffic instead of http

Can i forward tcp traffic on my localhost intead of http using SirTunnel? if so can you guide me what changes need to be done?

sirtunnel.py: command not found

I have this error how can I get the path sirtunnel.py on the server?

"remote port forwarding failed"

If my connection doesn't clean up well/network issue, I sometimes get this error:

Warning: remote port forwarding failed for listen port 11369

I have to change the port or restart / kill process with SirTunnel. Is there a way to have SirTunnel force override the port so this issue can be avoided?

Where do I need to run SirTunnel server instance and SSH server port 22?

Basically I have no idea what I'm doing.

From the section How do you use it? I still don't really understand where should I run those command.

let's say, I have a webserver running on PC and a Raspberry Pi.

Can you please kindly elaborate where should I run

run_server.sh
SSH server running on port 22 of example.com

And also do I need to have the PATH of sirtunnel.py in both Pi and PC?

Many thanks

should ./caddy say caddy in run_server.sh ?

Overview

Running ./run_server.sh on ubuntu 20.04 gives the following error

./run_server.sh: line 3: ./caddy: No such file or directory

Source Code

https://github.com/anderspitman/SirTunnel/blob/master/run_server.sh#L3

Possible Solution

Remove the ./ and replace ./caddy with caddy

Saved me!

this is an amazing project! saved me when i needed to do some forwarding

Opinion on URL routing

I'd like to know your opinion on implementing URL routing on top of tunnelling. This is my use case. I have a few IoT devices and each has a webserver installed on it. Now, I want to achieve remote access to the web dashboard and have the SSH access to it too by having a common DNS.

For example, lets say www.example.com is the domain. I want to access the IoT device's dashboard by www.example.com/DeviceId/web and for SSH, www.example.com/DeviceId/ssh

As far as I know, ngrok has this option available but expensive. I'd like to know if above use case can be achieved using this code with necessary changes.

{"error":"host not allowed: hostname}

I followed the guide and this happened. What should I do?

Invalid traversal path

Caddy error when starting ssh script;

request error{"error": "invalid traversal path at: config/apps/http/servers/sirtunnel/routes", "status_code": 500}

caddy_config.json:

{
  "apps": {
    "http": {
      "servers": {
        "[server_hostname]": {
          "listen": [":443"],
          "routes": [
          ]
        }
      }
    }
  }
}

Port 80 listening issue?

Hello! This seems pretty slick. I've had issues with serveo and localtunnel in the past. Hoping this will be "the answer."

I can get things working with this json config:

{
  "apps": {
    "http": {
      "servers": {
        "sirtunnel": {
          "listen": [":4443"],
          "routes": [
          ]
        }
      }
    }
  }
}

I've got nginx running on this system and need to use a non-standard port. The issue I get now is when I try to connect to sir tunnel, it looks like caddy is throwing this error:

2023/08/13 21:56:38.564 ERROR   admin.api       request error   {"error": "loading new config: http app module: start: tcp: listening on :80: listen tcp :80: bind: address already in use", "status_code": 500}

I'm currently exploring caddy docs trying to figure this out. Thought I'd ask here in the event someone knew how to change this. I think this is the last piece of the puzzle.