SSH over WAN in the Terminal...

Question

SSH over WAN in the Terminal...

Is it possible?

2.16GHz 17" Intel Core Duo MacBook Pro / 1.8GHz 20" iMac G5 / 60GB iPod (Video), Mac OS X (10.5.1), MacBook Pro - 1GB RAM, 120GB HD, APE, BT / iMac - 2GB RAM, 250GB HD, APE, BT

Posted on Nov 17, 2007 2:21 PM

Reply

Answer 1

Nov 17, 2007 3:07 PM in response to Preston Eaves

What exactly are you trying to do? ssh from your machine to some remote host through your cable modem / dsl, etc?

Reply

Answer 2

Dave Z

Level 1

60 points

Nov 17, 2007 3:19 PM in response to Preston Eaves

Yes. If you're behind a firewall, you'll need to forward the appropriate port.

You should be aware, enabling SSH over a WAN is a potentially serious security risk if not done properly. You'll probably want to establish proper authentication keys, etc.

At any rate, it's no different than SSH'ing into a LAN machine from termal (i.e. "ssh <destination ip>").

Reply

Answer 3

Nov 17, 2007 4:03 PM in response to brainslice

Yes. I'm trying to use ssh over the internet to control a host machine remotely.

Reply

Answer 4

Nov 17, 2007 4:15 PM in response to Dave Z

So would you include the Short Name in the command to connect to a host machine over a WAN just as you would if you if you were connecting to it over a LAN? (i.e. ssh preston@192.168.1.100) Also, you would use the external IP to connect to the host machine over a WAN, right? Also, what do you do if the host machine that you want to control is behind a router on their end? Meaning how do you include both the external IP (the one their router uses to connect to the internet) and the internal IP (the one assigned to the host machine by the router) in the ssh command? Because if you used just the external IP in the ssh command and there were multiple machines behind the router on their end, the router wouldn't know which machine to route the ssh command to, correct? Does that make any sense?

Message was edited by: Preston Eaves

Reply

Answer 5

Barney-15E

Level 10

122,306 points

Nov 17, 2007 4:39 PM in response to Preston Eaves

You have to turn on port forwarding on the router that the other machine connects to the internet from. Forward port 22 so that when the router sees traffic on port 22, it will send it to the appropriate computer on its subnet.

Reply

Answer 6

Nov 17, 2007 5:05 PM in response to Barney-15E

Thanks, now we're getting somewhere. So once I setup port forwarding in the router that the other computer connects to for port 22, would the command format for the terminal look like this?

ssh shortname@external_ip

Or do you NOT use the Short Name of the user on the other computer and instead have it look like this?

ssh external_ip

Reply

Answer 7

Nov 17, 2007 5:48 PM in response to Preston Eaves

I suggest reading the man page. In Terminal "man ssh"

You need to specify a username otherwise ssh will use your local username instead. This can be done a couple of ways....

ssh user@host
ssh -l user host

WARNING!!! If you're going to open up ssh to the public you'd better be darned sure that you're using strong passwords. It's also a good idea to disable root ssh login, you can always sudo or su when you're logged in.

Reply

Answer 8

Nov 17, 2007 5:59 PM in response to brainslice

How do you disable root ssh login?

Login to the root user > System Preferences > Sharing > Make sure the checkbox next to "Remote Login" is unchecked? Or are you talking about something completely different all together?

Reply

Answer 9

Nov 17, 2007 6:20 PM in response to Preston Eaves

It looks like the remote system is MacOSX so you need to edit the file /private/etc/sshd_config, doing so as root of course.

Find the line with "#PermitRootLogin yes" (this is the default) and change to "PermitRootLogin no"
Make sure you remove the leading hash to uncomment the line or it won't do anything. Save the file, log out then try to ssh root@host and see what happens.

Reply

Answer 10

Nov 17, 2007 7:18 PM in response to Preston Eaves

Thank you all so much for your help and guidance. Points have been applied where they are necessary.

Reply

Answer 11

tokyosky

Level 1

11 points

Nov 20, 2007 3:22 AM in response to Preston Eaves

This appeared today on mac osx hints at http://tinyurl.com/2oaae9

10.5: How to use screen sharing remotely and securely
Mon, Nov 19 '07 at 1:30PM PST • Submitted by mschmidl

I hope this helps.
Alan

Reply