sish 4.0.0

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened WireGuard VPN & VPN, Proxy and Remote Access AMIs listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for the full launch wizard. In Version, choose sish 4.0.0 on Ubuntu 24.04, then choose your Region.
• Pick an instance type and your key pair. m5.large is recommended. The software charge is $0.04 per vCPU per hour.
• Configure the security group. The listing's default group opens 22, 2222, 80 and 443. Restrict port 22 to your own IP address, and restrict port 2222 to the machines that will open tunnels.
• Choose a subnet that gives the instance a public IPv4 address, which the default sslip.io domain needs. Leave the metadata defaults, because the image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this command on your own workstation. It creates a security group, then launches the instance. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and replace the VPC, subnet, key pair and CIDR ranges with your own:

SG=$(aws ec2 create-security-group --group-name sish \
  --description "sish tunnel server" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 22 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 2222 --cidr <your-client-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 80 --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 443 --cidr 0.0.0.0/0
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=sish}]'

You do not need --metadata-options, because the AMI already requires IMDSv2. To keep the same tunnel domain across stop and start, associate an Elastic IP address and run sudo sish-set-domain --default once afterwards (see Step 8).

Connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

First boot finishes within a minute of launch. It generates the tunnel key, the host key and the TLS certificate, writes the configuration for this instance's domain, starts sish, and waits for ports 2222, 80 and 443.

The details are in /root/sish-credentials.txt, which only root can read. The file holds fingerprints and URLs, not key material:

sudo cat /root/sish-credentials.txt

# sish 4.0.0 - written by sish-firstboot on this instance. No key material is stored in this file.
# Tunnel key (private half): /root/sish-tunnel-key (0600 root). Copy it to your client machine, then shred it here.
# Open a tunnel:
ssh -p 2222 -i <key> -R myapp:80:localhost:8080 203.0.113.10.sslip.io -> https://myapp.203.0.113.10.sslip.io/
# Self-test:
sudo sish-selftest Change the domain:
sudo sish-set-domain tunnels.example.com
# Guide: https://secureanycloud.com/stacks/sish-4-0-0/ SISH_DOMAIN=203.0.113.10.sslip.io SISH_HOST=203.0.113.10 SISH_SSH_PORT=2222 SISH_TUNNEL_KEY_FILE=/root/sish-tunnel-key SISH_TUNNEL_KEY_FINGERPRINT=SHA256:q8T2n0kXc4Vd7mR1hZ5yLwE9aJ3uB6sPfG0tKxNcY2E SISH_HOST_KEY_FINGERPRINT=SHA256:Hk4wP9sQ2bV7nL1xR6tY3mC8dF0gJ5aZ2eU4iO7kWq0 SISH_TLS_CERT_SHA256=3A:91:5C:0E:7D:22:B8:4F:61:A0:9E:3D:C7:58:14:F2:6B:0D:93:E8:5A:27:C1:4E:80:BF:36:D9:72:1A:E5:0C SISH_EXAMPLE_HTTPS_URL=https://myapp.203.0.113.10.sslip.io/ SISH_EXAMPLE_HTTP_URL=http://myapp.203.0.113.10.sslip.io/

Your values differ, because every instance has its own domain, keys and certificate.

systemctl is-active sish sish-firstboot
sudo ss -Htlnp | awk '{print $4, $6}'

active active 127.0.0.54:53 users:(("systemd-resolve",pid=368,fd=17)) 127.0.0.53%lo:53 users:(("systemd-resolve",pid=368,fd=15)) 0.0.0.0:22 users:(("sshd",pid=888,fd=3),("systemd",pid=1,fd=86)) [::]:22 users:(("sshd",pid=888,fd=4),("systemd",pid=1,fd=87)) *:80 users:(("sish",pid=6466,fd=8)) *:2222 users:(("sish",pid=6466,fd=3)) *:443 users:(("sish",pid=6466,fd=9))

sish owns ports 2222, 80 and 443. The system SSH server keeps port 22 for administration, and nothing else listens on the network.

The self-test opens a real tunnel through sish on the instance itself, using the tunnel key. It fetches the tunnel over HTTPS (verified against the per-instance certificate) and over HTTP. It also checks that an unknown key is refused, that only public-key authentication is offered, and that ssh -W through sish reaches neither the metadata service nor the instance's own SSH server:

sudo sish-selftest

[sish-selftest] host key pinned; tunnel https://selftest3f0a12.203.0.113.10.sslip.io/ answers over TLS with the per-instance certificate, and over HTTP [sish-selftest] served certificate fingerprint = /etc/sish/ssl/sish.crt [sish-selftest] ssh -W through sish reaches a client's named alias (control) but neither the metadata service nor the instance's own SSH server [sish-selftest] an unauthorized key is refused [sish-selftest] password and keyboard-interactive authentication are not offered (publickey only) SELFTEST_OK

Run this command on your workstation. It copies the instance's tunnel key, which is the key that may open tunnels, into a file that only you can read:

umask 077 ssh -i ~/.ssh/my-key-pair.pem ubuntu@<SISH_HOST> 'sudo cat /root/sish-tunnel-key' > ~/.ssh/sish-tunnel-key ssh-keygen -l -f ~/.ssh/sish-tunnel-key

The fingerprint ssh-keygen prints must equal SISH_TUNNEL_KEY_FINGERPRINT in the credentials file. Keep this key private, because anyone who holds it can open tunnels on your server.

When the key is safely on your workstation, you can remove the server's copy. The authorized public half stays in /etc/sish/pubkeys/:

sudo shred -u /root/sish-tunnel-key

To let other people or machines open tunnels, give each one its own key instead of sharing this one. See Step 7.

On your workstation, start any local web app, for example on port 8080. Then run:

ssh -p 2222 -i ~/.ssh/sish-tunnel-key -R myapp:80:localhost:8080 <SISH_DOMAIN>

The first time you connect, SSH shows sish's host key fingerprint. Accept it only if it equals SISH_HOST_KEY_FINGERPRINT in the credentials file. sish then prints the URLs of your tunnel.

While the SSH session stays open, https://myapp.<SISH_DOMAIN>/ and http://myapp.<SISH_DOMAIN>/ serve your local app to anyone who can reach ports 80 and 443. Press Ctrl+C to close the tunnel. Add -N to run without a session, and add -o ServerAliveInterval=30 to keep long-lived tunnels open through NAT devices.

Browsers warn about the certificate because it is self-signed. Compare the fingerprint that the browser shows (SHA-256) with SISH_TLS_CERT_SHA256, or install a CA-issued certificate as shown in Step 8. Do not add the self-signed certificate to a trust store. On the instance, this command prints the fingerprint of the certificate that sish actually serves:

openssl s_client -connect 127.0.0.1:443 -servername myapp.<SISH_DOMAIN> </dev/null 2>/dev/null | openssl x509 -noout -fingerprint -sha256

sha256 Fingerprint=3A:91:5C:0E:7D:22:B8:4F:61:A0:9E:3D:C7:58:14:F2:6B:0D:93:E8:5A:27:C1:4E:80:BF:36:D9:72:1A:E5:0C

sish accepts the OpenSSH public keys in the files in /etc/sish/pubkeys/ and notices new files within seconds, without a restart. To let a colleague open tunnels, ask for their public key (for example id_ed25519.pub), copy it to the instance, and install it:

sudo install -o root -g sish -m 0640 your-laptop.pub /etc/sish/pubkeys/your-laptop.pub

To revoke a key, delete its file from /etc/sish/pubkeys/. sish refuses that key within seconds. Tunnels that the key already has open stay up until they disconnect, and sudo systemctl restart sish ends every open tunnel. List the authorized keys and their fingerprints:

sudo sh -c 'for k in /etc/sish/pubkeys/*.pub; do ssh-keygen -l -f "$k"; done'

To serve tunnels under a domain of your own, create two DNS records that point at the instance's public IP address. An Elastic IP address keeps the address stable. The records are tunnels.example.com and the wildcard *.tunnels.example.com. Then run:

sudo sish-set-domain tunnels.example.com

This re-renders /etc/sish/config.yml for the new domain, generates a new self-signed certificate for tunnels.example.com and *.tunnels.example.com, updates /root/sish-credentials.txt and restarts sish. The tunnel key, the host key and every authorized key are kept.

sudo sish-set-domain --default returns to <public-ip>.sslip.io. Also run it after the public IP address changes, for example after you associate an Elastic IP address.

To use a certificate from your own certificate authority or a public CA, obtain a certificate that covers the domain and its wildcard. Then replace the self-signed pair and restart sish:

sudo install -o root -g sish -m 0644 your-fullchain.pem /etc/sish/ssl/sish.crt
sudo install -o root -g sish -m 0640 your-privkey.pem /etc/sish/ssl/sish.key
sudo systemctl restart sish

Keep the file names sish.crt and sish.key. With public CAs such as Let's Encrypt, a wildcard certificate requires the DNS-01 challenge.

Consider a forward for a port other than 80 and 443, for example a database on your laptop:

ssh -p 2222 -i ~/.ssh/sish-tunnel-key -N -R 5432:localhost:5432 <SISH_DOMAIN>

sish binds this forward on 127.0.0.1 only, on a random free port between 1024 and 65535. It prints the forward as TCP: <domain>:<port>, but in this image that port is not reachable from the network. Reach it from the instance itself, or through the system SSH server (ssh -L). sish never binds a tunnel client's port on the instance's network interfaces or below 1024. To list the listeners that sish holds right now, run:

sudo ss -Htlnp | grep '"sish"'

A named alias (-R mydb:5432:localhost:5432) creates no port at all. Another authorized client connects to it with ssh -p 2222 -i <key> -W mydb:5432 <SISH_DOMAIN>. Aliases are the only thing a client's ssh -L or ssh -W can reach through sish.

To publish raw TCP ports to the network, change tcp-address in /usr/local/lib/sac/sish-config.yml.template and /etc/sish/config.yml, restart sish, and open the port range in the security group. Do this only if every key holder should be able to open public ports on this instance.

sudo journalctl -u sish-firstboot --no-pager -o cat | tail -3 systemctl status sish --no-pager | head -5

sish runs in the foreground under systemd, so its messages go to the journal (sudo journalctl -u sish). It logs SSH login attempts with the client address and public key, the tunnels opened and closed, and the connections made to those tunnels.