Molehill - a configurable ssh server for TCP port forwarding

I guess everybody knows the problem, you want to reach a resource behind a firewall, or need to fix up a device in a customers network, or need to connect to any other tcp port somewhere in the world. I would usually solve the issue for me by setting up an ssh serevr somewhere. But this always means that 2 parties (you and the network device that has access to your target) will need to have permissions to connect to the server, and if you are not carefull with config they could still get a shell, also it is annoying to setup the same config over and over again....

So I created molehill, a ssh server written in go, that only supports tcp forwards and nothing else. Additionally it uses socket files (unix domain sockets) to "store" all port connections while they are active so there are less possible clashes because of a certain port number being used twice. You can easily controll access via a simple yaml config file, and all during runtime (no need to restart molehill when adding clients)

Server Usage

Run the server like any other go binary

go build .
./molehill

When the server starts for the first time it will create a config.yml file in the current directory. This file can be edited and will automatically be reloaded on save, no need to restart the server

Running molehill in the background

If you want to run molehill as a service on your server please use systemd

TODO: Provide a simple systemd service script

Client Usage:

Just use the regular SSH Client on your computer

Connect to a resource on the server

ssh -N -L 9998:localhost:1 lukas@localhost -p 2222

Publish a resource to the server

ssh -N -R 1:127.0.0.1:8000 lukas@localhost -p 2222

Future: Mole client

use go install github.com/s00500/molehill/cmd/mole@master

TO BE DONE

This should also work well with: https://github.com/ferama/rospo

Donate

If you like this project you can buy me a coffee here

If you have any questions, ideas, iimprovements, or obvious bugs please open an issue or submit a PR.

TODO:

• log all connections, ignore forwarded port, ip-port -> filename
• Eventually allow to accept a new connection using a promt that is active for 30 seconds (It could also be email or telegram if you want :-))
• finally setup 2 mole commands to do client operation simpler
• Make sure the store lib knows yml and yaml!