moul / quicssh Goto Github PK

View Code? Open in Web Editor NEW

777.0 8.0 37.0 126 KB

SSH over QUIC

Home Page: https://manfred.life/quicssh

License: Apache License 2.0

Dockerfile 7.41% Makefile 5.44% Go 87.15%

ssh proxy quic cli daemon server hack

quicssh's Introduction

quicssh

😄 quicssh is a QUIC proxy that allows to use QUIC to connect to an SSH server without needing to patch the client or the server.

Architecture

Standard SSH connection

┌───────────────────────────────────────┐             ┌───────────────────────┐
│                  bob                  │             │         wopr          │
│ ┌───────────────────────────────────┐ │             │ ┌───────────────────┐ │
│ │           ssh user@wopr           │─┼────tcp──────┼▶│       sshd        │ │
│ └───────────────────────────────────┘ │             │ └───────────────────┘ │
└───────────────────────────────────────┘             └───────────────────────┘

SSH Connection proxified with QUIC

┌───────────────────────────────────────┐             ┌───────────────────────┐
│                  bob                  │             │         wopr          │
│ ┌───────────────────────────────────┐ │             │ ┌───────────────────┐ │
│ │ssh -o ProxyCommand "quicssh client│ │             │ │       sshd        │ │
│ │     --addr %h:4545" user@wopr     │ │             │ └───────────────────┘ │
│ │                                   │ │             │           ▲           │
│ └───────────────────────────────────┘ │             │           │           │
│                   │                   │             │           │           │
│                process                │             │  tcp to localhost:22  │
│                   │                   │             │           │           │
│                   ▼                   │             │           │           │
│ ┌───────────────────────────────────┐ │             │┌─────────────────────┐│
│ │  quicssh client --addr wopr:4545  │─┼─quic (udp)──▶│   quicssh server    ││
│ └───────────────────────────────────┘ │             │└─────────────────────┘│
└───────────────────────────────────────┘             └───────────────────────┘

Usage

$ quicssh -h
NAME:
   quicssh - A new cli application

USAGE:
   quicssh [global options] command [command options] [arguments...]

VERSION:
   0.0.0

COMMANDS:
     server
     client
     help, h  Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --help, -h     show help (default: false)
   --version, -v  print the version (default: false)

Client

$ quicssh client -h
NAME:
   quicssh client -

USAGE:
   quicssh client [command options] [arguments...]

OPTIONS:
   --addr value  (default: "localhost:4242")
   --help, -h    show help (default: false)

Server

$ quicssh server -h
NAME:
   quicssh server -

USAGE:
   quicssh server [command options] [arguments...]

OPTIONS:
   --bind value  (default: "localhost:4242")
   --help, -h    show help (default: false)

Install

$ go get -u moul.io/quicssh

Resources

https://korben.info/booster-ssh-quic-quicssh.html

License

quicssh's People

Contributors

Stargazers

Watchers

quicssh's Issues

Can it be used as a generic TCP over QUIC forwarder?

Is it quicssh essentially SSH-specific or it can handle any TCP connections?

Where can I override destination port 22?

Idea: use host keys from /etc/ssh/ to bootstrap the QUIC socket

can I set the timeout ?

I had set a very long timeout for ssh, but quicssh was timeout in a few minutes.

Unable to connect over port 53

I've enabled UDP traffic over port 53 on the server

I started the server with:

sudo ./quicssh server --bind "0.0.0.0:53"

and client with:

sudo ./quicssh client --addr <redacted>:53

However I keep getting panic: timeout: no recent network activity
I confirmed that I am able to connect to the server on port 998

panic: qtls.ConnectionState not compatible with tls.ConnectionState

Run server command got panic with error: panic: qtls.ConnectionState not compatible with tls.ConnectionState.
please check it.

X11 Forwarding?

Is X forwarding possible with QUICSSH? If not, can it be? :)

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

fix(deps): update module github.com/quic-go/quic-go to v0.42.0 [security]
fix(deps): update module golang.org/x/net to v0.23.0 [security]
chore(deps): update all (alpine, circleci/golang, github.com/urfave/cli/v2, golang)
Click on this checkbox to rebase all open PRs at once

Detected dependencies

circleci

.circleci/config.yml

circleci/golang 1.16

dockerfile

Dockerfile

golang 1.19.5-alpine

alpine 3.18.0

gomod

go.mod

go 1.20

github.com/quic-go/quic-go v0.35.1

github.com/urfave/cli/v2 v2.25.6

golang.org/x/net v0.11.0

Check this box to trigger a request for Renovate to run again on this repository

does not exit on server connection loss

If the TCP connection to the ssh server is lost (closed by the ssh server), the quicssh client does not exit.

Missing discussion in README of why this instead of mosh

The readme is missing any discussion of why someone would use this instead of mosh.

In general, mosh is a story for something very close to "ssh over quic" for most users -- with the major caveat that quic didn't exist when mosh was originally written, so mosh uses its own UDP protocol.

My impression is that this does have a few usecases, such as if there's a firewall that allows QUIC but not generic UDP, but it's probably worth calling those out.