SSH Tunnel on Windows RDP

Architecture

• User Story :
  From Client connect to Target by using ssh tunnel through Public Server
  

Prepare

1. Target-Windows

   • 需要 Windows 專業版

   • 開啟遠端桌面 (https://support.microsoft.com/zh-tw/windows/如何使用遠端桌面-5fe128d5-8fb1-7a23-3b8a-41e636865e8c)

   • Allow Firewall: Remember to do this
     Click Red -> Blue
     

     
     
     
     
     
     
     
     
     
     

   • Can use ssh to connect to Machine A

2. Client

   • Can use ssh command and connect to Machine A
   • If Macos -> Download Windows App (https://apps.apple.com/tw/app/windows-app-mobile/id714464092)

3. Public Server (linux)

   • Prepare a unbind port for connecting
   • Setting ssh config
     I. Find out ssh config docs
     $service ssh status
     
     
     II. Modify ssh config /etc/ssh/sshd_config
     • Remember to set AllowTcpForwarding yes, below is example of sshd_config.
     ​​​​​​​​
     ​​​​​​​​Protocol 2
     ​​​​​​​​UseDNS no
     ​​​​​​​​ClientAliveCountMax 3
     ​​​​​​​​ClientAliveInterval 15
     ​​​​​​​​VersionAddendum none
     ​​​​​​​​Ciphers +aes128-cbc
     ​​​​​​​​Port 22
     ​​​​​​​​# PermitRootLogin without-password
     ​​​​​​​​AllowTcpForwarding yes
     ​​​​​​​​Compression no
     ​​​​​​​​PasswordAuthentication yes
     ​​​​​​​​PubkeyAuthentication yes
     ​​​​​​​​GatewayPorts yes
     ​​​​​​​​AuthorizedKeysFile /etc/ssh/authorized_keys
     
     ​​​​​​​​# These are forced to be enabled with 2FA
     ​​​​​​​​UsePAM no
     ​​​​​​​​ChallengeResponseAuthentication no
     ​​​​​​​​PrintMotd no
     ​​​​​​​​SetEnv LC_ALL=C.UTF-8
     
     ​​​​​​​​# Sftp setting
     ​​​​​​​​Subsystem sftp internal-sftp
     

   III. Restart SSH service
   $service ssh restart

How to Do

• Machine A : Just do nothing and wait for connect.

• Machine B

  • Run below Script to export (B: port Z) to (A: Port X)
    ssh -R X:B_IP:Z A_username@A_ip
ssh -R 11111:10.0.0.2:3389 root@123.4.5.6

• Machine C (windows)

  • Run below Script to link (A: port X) with (C: port Y)
    ssh -L Y:C_ip:Z A_username@A_ip
ssh -L 22222:127.0.0.1:11111 root@123.4.5.6
  • Connect to Target-win, and the Account&Password is your windows(Microsoft) Email&Password
    

• Machine C (MacOS)

  • Open terminal and run below Script to link (A: port X) with (C: port Y)
    ssh -L Y:C_ip:Z A_username@A_ip
ssh -L 22222:127.0.0.1:11111 root@123.4.5.6
  • Open windows app and Add PC (127.0.0.1:22222), then U can connect to Target

Additional

• SSH useful cmd

  • -N : Do not execute remote commands, used mainly for port forwarding.
  • -f : Makes SSH run in the background.
  • Can use -fN at Machine B to run in background.
  • Can use -N at Client, just not execute remote commands.

• Windows Startup Script to Run ssh tunnel at power up (Machine B)
  I. Set Env
  - Check current setting
  Get-ExecutionPolicy
  - Run Powershell by Admin
  Set-ExecutionPolicy Unrestricted
  

  II. Create Startup Script
  - Create a script.ps1 and run.bat
  - script.ps1:
  $sshCommand = "ssh -fN -R X:B_IP:Z A_username@A_ip"
Start-Process powershell -ArgumentList "-Command", $sshCommand -NoNewWindow
  - run.bat
  Powershell.exe -executionpolicy remotesigned -File C:\Users\USER\FOLDER\script.ps1
  III. Set Startup Script
  - Type win+R key in shell:startup, it'll show a folder of startup
  

  
  - Create a Shortcut in startup folder
  
  
  - Good! Finished! This script will run at powerup

• TODO: autossh

Reference

• Microsoft Windows 遠端桌面
  https://support.microsoft.com/zh-tw/windows/如何使用遠端桌面-5fe128d5-8fb1-7a23-3b8a-41e636865e8c
• 好用SSH tunnel教學
  https://johnliu55.tw/ssh-tunnel.html
• App store Windows app
  https://apps.apple.com/tw/app/windows-app-mobile/id714464092
• Powershell Docs
  https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4