This utility aims to make it easy to work with an IoT device that's connected to your computer, but not connected to the internet. It does this by temporarily providing a proxy through your internet connection. To get started (assuming you have a built executable):
- Run
sshterm -hostname <my_host> -user <my_user>
- Enter your password when prompted
- Run
export-wot-proxy
once logged in
Everything you run in that session should now have access to the internet via a socks5 proxy on localhost:10800
.
I have a web-of-things device (for example, an OpenFlexure Microscope), connected to my computer via a network cable. This is simple, reliable, and fast, and I can use my microscope just fine. However, I can't do a software update, because that requires the microscope to connect to the internet.
I could, of course, connect my microscope to WiFi, but if I don't have a suitable network available (e.g. I'm at work, with complicated Eduroam WiFi, or I'm in a location that requires browser-based authentication, which is a pain from a headless device) I'm stuck. That leads to me messing about with extra routers, or trying to set up internet connection sharing, all of which are complicated, unreliable, and in many cases very much against the policy of my IT department.
I can connect to my microscope using ssh
and create a "reverse tunnel" back a proxy server on my computer. This allows temporary use of my computer's internet connection by the microscope, e.g. to download a software update. On Linux, everything you need to do this is provided by ssh
and sshd
with appropriate configuration. On Windows, however, it doesn't work because the SSH client doesn't have the requisite proxy server feature enabled in the "reverse" direction.
This little Go project bundles up everything I need into a single executable. When run from the command line, it:
- Makes an SSH connection to the device
- Creates a reverse tunnel (on port 10800)
- Runs a SOCKS5 proxy on my computer, listening to the tunnel
- Sets the date on the remote machine (with
sudo date
) - Adds bash aliases to set the proxy environment variables
Currently its configuration options are limited, but I expect it will be a really handy utility for updating Web of Things devices on "dark" networks. This should solve a longstanding and really annoying limitation of such devices in University labs, where (for good reasons) campus IT administrators are generally very unwilling to allow these devices on the main network. I hope this means that "dark" networks (i.e. not directly connected to either the secure campus network or the internet) become a bit easier to manage.
This program currently runs and works on my Windows laptop, connecting to a locally-connected Raspberry Pi running a customised Raspberry Pi OS. It supports password authentication, accepting the password on the command line, and takes command-line arguments for username, hostname, and port number. Once connected, several commands are run - configuration for these is very much a to-do I'm afraid. The commands are echoed to the terminal so you can see what it's done. Commands are:
- Set the date on the Pi (because there's no RTC on a Pi, the date is often wrong and this will cause security warnings):
sudo date -s "%s"
where%s
is today's date/time on your computer. - Create a configuration file for
proxychains
at~/.proxychains-wot-updater.conf
pointing to localhost:10800. - Create several new lines in your
~/.bashrc
file on the Pi usingalias
to define new commands:
export-wot-proxy
sets your proxy environment variables (http_proxy
,https_proxy
,all_proxy
and the same in upper-case) tosocks5h://127.0.0.1:10800
. It also configuresproxychains
to use the configuration file from (2).export-empty-proxy
sets the proxy environment variables to""
, disabling the proxy. It doesn't reset theproxychains
configuration. Typically, if you have a command that doesn't work afterexport-wot-proxy
you can use this command to disable the proxy, then tryproxychains <your command>
to use proxychains instead.sudo-wot-pc
will run a command as root, with no proxy environment variables set, usingproxychains
to redirect network requests through the proxy.skip-git-lfs
anddont-skip-git-lfs
allow you to skip the LFS "smudge" filter when usinggit
. Becausegit-lfs
is written in Go, it won't work with proxychains, and it may not know to send DNS queries via the proxy: this can lead togit
hanging after it's retrieved the references. If you don't need LFS files,skip-git-lfs
may be all you need to get it working.
I use libproxychains4
to connect to the proxy if, for whatever reason, the environment variables are ignored or the program doesn't support it. With the proxy variables exported (e.g. by typing export-wot-proxy
in the session) most things work (pip
, sudo apt ...
, etc.) but there are edge cases that fail (see below).
git-lfs
seems not to use the proxy correctly (I believe this is due to a difference in how the Go http libraries work vs libc). Currently I work around this by exportingGIT_LFS_SKIP_SMUDGE=1
which is aliased todisable-git-lfs
by this script.
Currently this is not packaged/built automatically. You will need to:
- Install Go
- Clone the repository
- Obtain the requisite libraries:
go mod tidy
- Compile and run the program:
go run ./sshterm
You can build a stand-alone, statically linked binary for your platform with go build ./sshterm
. Once this is a bit more ready for use, I'll build it automatically in the CI.