Skip to content

Don't rely on ssh TCP port forwarding #92

Closed
Closed
Don't rely on ssh TCP port forwarding#92
Labels
feature-requestRequest for new features or functionalitysshIssue in vscode-remote SSH

Description

@davidwin
David Windehem (davidwin)
opened on May 3, 2019

The initial release of the VS Code Remote extension relies on SSH port forwarding between the client and server to make the HTTP endpoint for the extension host on the server appear as a local TCP port on the client. While this is a simple solution, it completely blocks use of the extension in environments where port forwarding has been disabled for security reason by setting AllowTCPForwarding to No.

For instance, I'm not able to use this feature in an enterprise setting with "dev servers" that otherwise pretty much fits one of the intended use cases. Issue #84 is probably also blocked for the same reason.

I suggest implementing a custom forwarding/multiplexing solution on top of a plain ssh connection to the remote server instance. Perhaps TCP sockets could be avoided completely that way.

Anyway, great work so far and I'm looking forward to testing this for real one day!

Activity

  1. davidwin commented on May 3, 2019

    @davidwin
    David Windehem (davidwin)
    on May 3, 2019
    Author

    For reference, the Port Forwarding section on ssh.com notes that:

    Enterprises would generally want to prevent port forwarding on their servers, unless expressly needed for tunneling legacy applications. There is substantial risk that users will use SSH tunneling to open backdoors into the organization through the firewall to get access to work machines from home. We've seen this done in numerous organizations and the technique is widely known.

    One could argue whether there is an actual risk or not, but I wouldn't be surprised if many enterprises followed this advice.

  2. roblourens
    added
    doc
    feature-requestRequest for new features or functionality
    sshIssue in vscode-remote SSH
    on May 4, 2019

  3. christian-ehrisman commented on May 5, 2019

    @christian-ehrisman
    Christian Ehrisman (christian-ehrisman)
    on May 5, 2019

    to get access to work machines from home

    This right here is the key, Unless you have a company culture that does not allow it, bending the rules in order to do more work is never punished and more of then than not rewarded.

  4. Dani21 commented on Jul 11, 2019

    @Dani21
    Daniel (Dani21)
    on Jul 11, 2019

    to get access to work machines from home

    This right here is the key, Unless you have a company culture that does not allow it, bending the rules in order to do more work is never punished and more of then than not rewarded.

    It doesn't even necessarily have to do with your own company's culture either. If you're working with a vendor and they don't allow port forwarding, then all of a sudden this plugin doesn't work at all. I would've loved to use this extension but I'm uninstalling it now at least until this feature is taken care of. I've subscribed to getting a notification once this issue is closed, but for now, bye.

  5. tbennett6421 commented on Aug 13, 2019

    @tbennett6421
    Tyler Bennett (tbennett6421)
    on Aug 13, 2019

    subscribed. We do not have the ability to enable AllowTcpForwarding on dev boxes

  6. Chuck Lantz (Chuxel)
    removed
    doc
    on Aug 13, 2019

  7. Vultour commented on Aug 16, 2019

    @Vultour
    Vultour
    on Aug 16, 2019

    We’ve got hundreds of developers eager to use the remote ssh extension, unfortunately this is blocking the rollout.

  8. alfonsomhc commented on Sep 2, 2019

    @alfonsomhc
    Alfonso MHC (alfonsomhc)
    on Sep 2, 2019

    Same here, we can't enable AllowTcpForwarding ...

  9. ekouters commented on Sep 10, 2019

    @ekouters
    Erik Kouters (ekouters)
    on Sep 10, 2019

    Same here, AllowTCPForwarding is not an option for us.

  11. Kai3620 commented on Oct 25, 2019

    @Kai3620
    Kai (Kai3620)
    on Oct 25, 2019

    Seriously, +1 on this. Am a college CS student. Our campus server dev environment does not have AllowTCPForwarding enabled, with no plans to change that. A different solution is a must.

  12. wwarriner commented on Oct 25, 2019

    @wwarriner
    William Warriner (wwarriner)
    on Oct 25, 2019

    I am working in a cluster environment. We need to do computation (like with a Jupyter notebook) on compute nodes. The server therefore needs to be set up on a compute node. But the compute nodes have ports restricted except SSH and a few other application-specific ports. So +1 on this!

  13. soloji commented on Dec 5, 2019

    @soloji
    soloji
    on Dec 5, 2019

    AllowTCPForwarding is not an option for us.

  14. briantist commented on Jan 30, 2020

    @briantist
    Brian Scholer (briantist)
    on Jan 30, 2020

    Same, can't use this feature at all because it relies on this setting.

  15. RokuKent commented on Feb 4, 2020

    @RokuKent
    K Sandvik (RokuKent)
    on Feb 4, 2020

    My 1and1 ISP account has AllowTcpForwarding disabled, I would not be surprised if that's the default for most ISPs due to security restrictions.

  16. alexanderwiller commented on Feb 25, 2020

    @alexanderwiller
    Alexander Willer (alexanderwiller)
    on Feb 25, 2020

    Same here, can't use this extremely useful feature because I'm working in an environment that has AllowTcpForwarding no set.

    Seriously, being able to use this extension without TCP forwarding would help spreading the word about the abilities of vscode so much, because in an enterprise you often have no choice but to live with the settings as a given. I would love to use vscode remote instead of local-vim, which is just not comparable at all.

  17. tomaszkaliciak commented on Jun 7, 2020

    @tomaszkaliciak
    tomaszkaliciak
    on Jun 7, 2020

    Same, this could be a game changer.

  18. gyzerok commented on Jun 8, 2020

    @gyzerok
    Fedor Nezhivoi (gyzerok)
    on Jun 8, 2020

    roblourens I've noticed in another thread you are saying there are no plans to implement this right now.

    Can you, please, lock this issue so there are no more same here comments?

    I would like to stay subscribed to the issue in case your plans will change in the future.

  19. microsoft
    locked and limited conversation to collaborators on Jun 8, 2020

  20. roblourens commented on Dec 17, 2022

    @roblourens
    roblourens
    on Dec 17, 2022
    Member

    The Remote-Tunnels/code server route will be the way forward for this scenario. It's not really practical for us to implement without forwarding https://marketplace.visualstudio.com/items?itemName=ms-vscode.remote-server

  21. roblourens
    closed this as completedon Dec 17, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    feature-requestRequest for new features or functionalitysshIssue in vscode-remote SSH

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions