Skip to content
Skip to main content
SSHepherd Documentation
< All Topics
Print

Creating a Generic (TCP/IP) Application Session

Applies to SSHepherd 2.0

Overview

Besides RDP and SSH, SSHepherd® protects any TCP/IP application, such as a web server, database or Telnet service. The application listens only on the host itself, and users reach it through a Generic tunnel to a port on their own computer. In SSHepherd 1.x, this tunnel type was called “Other App”.

Any application, as a local port · 2:42

Some examples:

Contact us if you’d like instructions for another application.

There are two ways to give users a Generic tunnel:

  • Allow the port on the agent, and users open tunnels to it themselves with shepctl.
  • Create a Generic tunnel definition and assign it to users or groups. Users open it by name. This also lets the tunnel reach a service on another machine behind the agent. See Tunnel Definitions.

Allow the application’s port on the agent

An administrator adds the application’s port to the agent’s Allowed Ports:

  1. In the Administrator Console, click Agents and select the host.
  2. Click the Settings tab.
  3. In Allowed Ports, add the port, for example 80. Separate several ports with commas.
  4. Click Save.

The change reaches the agent within seconds; you don’t need to restart it. Users can now open tunnels to that port, and to no other port except those listed.

Agent Settings tab, Allowed Ports field

In SSHepherd 1.x, ports were allowed with shepagent --port <port> add-whitelist or by editing agent.conf. These methods don’t apply to 2.0.

Create a tunnel with shepctl

On your computer, sign in with shepctl, then run:

shepctl --hostname <agent host name> --relayport 80 tunnel

shepctl prints the local port it chose, for example:

tunnel open on localhost: 24183

Open the application at 127.0.0.1 on that port, for example http://127.0.0.1:24183. Press Ctrl+C to close the tunnel.

Use a fixed local port

Add --port to choose the local port:

shepctl --hostname <agent host name> --relayport 80 --port 9999 tunnel

The application is now at 127.0.0.1:9999.

Other options

OptionUse
--hostid <host id>Use the host ID instead of the host name.
--bindip <ip address>Listen on another local address instead of 127.0.0.1
--relaytunnel <host>:<port>Reach a service on another machine through the agent, for example --relaytunnel 10.0.0.5:5432. The agent must allow that exact target; the text must match exactly, so localhost:8080 and 127.0.0.1:8080 are different targets. For most uses, a Generic tunnel definition is simpler.

Note: If the agent doesn’t allow the port, shepctl still prints “tunnel open on localhost”, but every connection closes straight away. If that happens, check the agent’s Allowed Ports.

Use the Control App

The easiest way for Control App users is a Generic tunnel definition created by an administrator:

  1. Ask your administrator to create a Generic tunnel definition for you. See Tunnel Definitions.
  2. Start the Control App and sign in. The tunnel is in your list.
  3. Switch the tunnel on.
  4. Open the application at 127.0.0.1 on the tunnel’s local port. The port is shown in the shepctl console window that the Control App opens.

Note: In 2.0, Generic tunnels created in the Control App itself don’t save their remote host and port, so they can’t connect. Use a tunnel definition created in the Administrator Console, or shepctl.

In This Article