Stream Redirector
Copyright (C) 2005, By Jason Nunn <jsno8192@gmail.com>
Birdwood, South Australia
-----------------------------------------------------------------------------

This program works around a problem with ssh tunnelling. In order to
setup a ssh tunnel (ie "/usr/bin/ssh -q -T -N -f -L 631:unary.home:631
root@unary.home"), the listening ssh service must be listening and
reachable. If the remote servicer (for example) is down, then the ssh
client just bombs out, and the tunnel isn't set up.

The method I outline in the project, allows you to setup ssh tunnelling,
regardless of whether the server is up or down.

This program is used inconjunction with "xinetd" and "ssh" (openssh) to
transmit encrypted services from a client to a server. This is how it
works (using the example of CUPS printer service 631)

  - xinetd is configured to listen in on 631--

/etc/xinetd.d/ssh_631
--$----------------------------------------
service ipp
{
        disable         = no
        socket_type     = stream
        wait            = no
        user            = root
        server          = /usr/bin/ssh
        server_args     = -q root@unary /usr/local/sbin/stre -a localhost:631
        log_on_failure  += USERID
}
--$----------------------------------------

  - connection is made to 631 by a client program (ie a web browser)

  - xinetd then runs the "/usr/bin/ssh" client program.

  - This ssh program tells the sshd daemon at the remote server end to
run the "/usr/local/sbin/stre" (Redirector) command. "stre" is parsed an
address and port to redirect the connection (ie localhost:631).

  - Encrypted data then goes from your client program, through the ssh 
encrypted stream to "stre".

 - "stre" then redirects stream to the cups daemon server.


+-------+    +------+     +---+           +----+    +----+      +-------+
|client |<-->|xinetd|<--->|ssh|<--------->|sshd|<-->|stre|<---->|remote |
|program|    +------|     +---+           +----+    +----+      |service|
+-------+                                                       +-------+


This might seem like a round about way of doing it... but, it saves
having to seriously hack openssh (and those guys probably wouldn't want
to have their nice standard changed), and it secures given services very
simply ;)

My application is to secure my 110, 25 and 631 services over my local 
wireless link to my internet gateway.


Installation
------------

- Copy distribution into servicer side as follows--

    - Optional-- Edit the make.config file. Set INSTALL_PATH if desired.

    - Run "make" and then "make install"

- Edit /etc/xinetd/* entries on client side. See examples in ./config 
file.


Contacts
--------

Email: jsno8192@gmail.com
WWW:   http://jsno.leal.com.au


:Jason Nunn
 Tue Feb 15 23:17:57 CST 2005
