listening to range of port

[mrjy81]

hi is there any way to listen to range of ports instead of only single port like 10022?

thanks in advanced

[manfred-kaiser]

SSH-MITM only supports 1 port for incoming connections. The default port is 10022.

If you need to listen to different ports, you can create some firewall rules to redirect the incoming traffic to SSH-MITM's port 10022.

You can use the transparent proxy mode, which is able to intercept all incoming traffic: https://docs.ssh-mitm.at/user_guide/transparent.html

SSHMITM's transparent mode uses Linux TProxy for transparent proxy support: https://docs.kernel.org/networking/tproxy.html

Cloudflare wrote an interesting article how to build a proxy server with Linux TProxy which is able to "bind to all ports": https://blog.cloudflare.com/how-we-built-spectrum/

I would recommend you to read this article because it has some information how to configure SSH-MITM for your scenario.

Important: Please keep in mind that transparent mode requires scenario specific configuration. Because of this, it's hard for me to give support for SSH-MITM's transparent mode.

Hint: Please ⭐ this project 😉

[mrjy81]

thank you so much and i got the hint 😉
there is a problem with Port forwarding or tproxy which is what If the ssh server listen at port 5000 or whatever again this tool think target server port is 22 is there any way to solve this?

[manfred-kaiser]

If you are using transparent mode, the destination server should be set dynamic. SSH-MITM should connect to the same server as the client specified. The connection information is read from the socket.

Please try the AppImage for version 3.0.2: https://github.com/ssh-mitm/ssh-mitm/releases/tag/3.0.2
If you want to install SSH-MITM from pypi.org, you should use following command to install a compatible paramiko version:

pip install ssh-mitm 'paramiko>=3,<3.2'

If you are using the latest version from the repository, there might be an error in setting the configuration for transparent mode. I will check it.

[mrjy81]

I don't know how to thank you for your attentions i really appreciate

using appimage server --transparent when i try to connect to it the tool keeps creating and closing sessions continuously and it's a strange behaviour in latest version
and I also tried version 2.0.3 but again same behavior repeats

[manfred-kaiser]

using appimage server --transparent when i try to connect to it the tool keeps creating and closing sessions continuously and it's a strange behaviour in latest version and I also tried version 2.0.3 but again same behavior repeats

It seems you are trying to connect from the same machine where SSH-MITM is running or you don't have configured the appropiate firewall rules for your scenario.

I recommend you to start with the example scenario from the docs. You need 3 servers and 2 different networks to setup the example scenario!

This way you can learn how to configure the Linux TProxy feature.

The docs are only describing basic firewall rules to work with SSH-MITM in transparent mode. Other tools like the http proxy Squid also supports Linux TProxy. The Squid proxy documentation is really good and has a lot of information on how to configure your firewall.

The SSH-MITM part is all done with the --transparent parameter and you should only configure --remote-host and --remote-port if you want to override the given destination from TProxy.