
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
tunnel-ssh
Advanced tools
The tunnel-ssh npm package allows you to create SSH tunnels in Node.js applications. This can be useful for securely connecting to remote servers, databases, or other services that require SSH tunneling.
Basic SSH Tunnel
This code sample demonstrates how to set up a basic SSH tunnel using the tunnel-ssh package. The configuration object includes details such as the SSH username, host, port, destination host and port, local host and port, and the private key for authentication.
const tunnel = require('tunnel-ssh');
const config = {
username: 'user',
host: 'remote.server.com',
port: 22,
dstHost: '127.0.0.1',
dstPort: 27017,
localHost: '127.0.0.1',
localPort: 27017,
privateKey: require('fs').readFileSync('/path/to/private/key')
};
tunnel(config, function (error, server) {
if (error) {
console.error('SSH connection error: ', error);
} else {
console.log('SSH tunnel established');
}
});
SSH Tunnel with Forwarding
This code sample shows how to set up an SSH tunnel with port forwarding. The 'keepAlive' option is set to true to maintain the connection. This is useful for applications that need to keep a persistent connection to a remote database or service.
const tunnel = require('tunnel-ssh');
const config = {
username: 'user',
host: 'remote.server.com',
port: 22,
dstHost: '127.0.0.1',
dstPort: 3306,
localHost: '127.0.0.1',
localPort: 3306,
privateKey: require('fs').readFileSync('/path/to/private/key'),
keepAlive: true
};
tunnel(config, function (error, server) {
if (error) {
console.error('SSH connection error: ', error);
} else {
console.log('SSH tunnel with forwarding established');
}
});
Dynamic Port Forwarding
This code sample demonstrates how to set up a dynamic SSH tunnel, which can be used as a SOCKS proxy. The 'dynamic' option is set to true, allowing the tunnel to dynamically forward traffic to different destinations.
const tunnel = require('tunnel-ssh');
const config = {
username: 'user',
host: 'remote.server.com',
port: 22,
dstHost: '0.0.0.0',
dstPort: 0,
localHost: '127.0.0.1',
localPort: 1080,
privateKey: require('fs').readFileSync('/path/to/private/key'),
dynamic: true
};
tunnel(config, function (error, server) {
if (error) {
console.error('SSH connection error: ', error);
} else {
console.log('Dynamic SSH tunnel established');
}
});
The ssh2 package is a more general-purpose SSH client for Node.js. It provides a wide range of SSH functionalities, including tunneling, executing commands, and file transfers. Compared to tunnel-ssh, ssh2 offers more flexibility and control over SSH connections but requires more setup and configuration.
The node-ssh package is a high-level SSH client for Node.js that simplifies the process of connecting to SSH servers, executing commands, and transferring files. It is easier to use than ssh2 but offers less control over the SSH connection. It is a good alternative to tunnel-ssh for users who need basic SSH functionalities without the complexity.
The ssh2-sftp-client package is built on top of ssh2 and provides a simplified API for SFTP (SSH File Transfer Protocol) operations. While it focuses on file transfers, it can also be used to create SSH tunnels. It is a good choice for users who primarily need SFTP capabilities with occasional SSH tunneling.
Simple SSH tunneling in node.js
npm install tunnel-ssh
var config = {
remotePort: 27017, //localport
localPort: 27017, //remoteport
verbose: true, // dump information to stdout
disabled: false, //set this to true to disable tunnel (useful to keep architecture for local connections)
sshConfig: { //ssh2 configuration (https://github.com/mscdex/ssh2)
host: '<yourRemoteIp>',
port: 22,
username: 'root',
privateKey: require('fs').readFileSync('<pathToKeyFile>'),
passphrase: 'verySecretString' // option see ssh2 config
}
};
var tunnel = new Tunnel(config);
tunnel.connect(function (error) {
console.log(error);
//or start your remote connection here ....
//mongoose.connect(...);
//close tunnel to exit script
tunnel.close();
});
var config = {
remoteHost: '<mysql server host>', // mysql server host
remotePort: 3306, // mysql server port
localPort: 33333, // a available local port
verbose: true, // dump information to stdout
disabled: false, //set this to true to disable tunnel (useful to keep architecture for local connections)
sshConfig: { //ssh2 configuration (https://github.com/mscdex/ssh2)
host: '<ssh server host>',
port: 22,
username: 'root',
privateKey: require('fs').readFileSync('<pathToKeyFile>'),
passphrase: 'verySecretString' // option see ssh2 config
}
};
var tunnel = new Tunnel(config);
tunnel.connect(function (error) {
console.log(error);
//or start your remote connection here ....
//mongoose.connect(...);
//close tunnel to exit script
tunnel.close();
});
mysql config
mysql_config = {
host: '127.0.0.1',
port: '33333',
user: 'xxx',
password: 'xxx'
}
FAQs
Easy extendable SSH tunnel
The npm package tunnel-ssh receives a total of 97,124 weekly downloads. As such, tunnel-ssh popularity was classified as popular.
We found that tunnel-ssh demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.