hakim
6th August 2004, 04:49 PM
I recently found out that you can forward ports for nearly any ip traffic via SSH (locally).
Start with an SSH tunnel using -L switch (local)
root@redgate:~# ssh -f -N -L110:mailhost:110 -l user mailhost
You must be root because this is going to bind you to a privileged port (110=POP, comment out POP daemon in /etc/xinetd.conf). To encrypt all POP traffic config the mail client to connect to localhost port 110.
The -f forks ssh into the background, and -N tell it not to actually run a command on the remote end just do forwarding (you may also use -C for compression, speeds up download time). You may also forward outbound traffic.
root@redgate:~# ssh -f -N -L110:mailhost:110 -L25:mailhost:25 \ -l user mailhost
Next set outbound email host to localhost, and your email traffic will be encrypted as far as mailhost. Please note this is more useful for local forwarding where security is not trusted (e.g. wireless). As an added precaution you may use gpg to make sure once outbound mail leaves mailhost it will remail encrypted.
see: http://www.gnupgp.org
For More information see: Linux Server Hacks by: Rob Flickenger (O'reilly) (http://www.oreilly.com/catalog/linuxsvrhack/)
Start with an SSH tunnel using -L switch (local)
root@redgate:~# ssh -f -N -L110:mailhost:110 -l user mailhost
You must be root because this is going to bind you to a privileged port (110=POP, comment out POP daemon in /etc/xinetd.conf). To encrypt all POP traffic config the mail client to connect to localhost port 110.
The -f forks ssh into the background, and -N tell it not to actually run a command on the remote end just do forwarding (you may also use -C for compression, speeds up download time). You may also forward outbound traffic.
root@redgate:~# ssh -f -N -L110:mailhost:110 -L25:mailhost:25 \ -l user mailhost
Next set outbound email host to localhost, and your email traffic will be encrypted as far as mailhost. Please note this is more useful for local forwarding where security is not trusted (e.g. wireless). As an added precaution you may use gpg to make sure once outbound mail leaves mailhost it will remail encrypted.
see: http://www.gnupgp.org
For More information see: Linux Server Hacks by: Rob Flickenger (O'reilly) (http://www.oreilly.com/catalog/linuxsvrhack/)
