Post #2144139 · Elektrine

2026-05-06 22:42 UTC

I have a “I wonder if this can be done” question about #ssh and #http. I’ve got a VPS on which I would like to stand up a few services that don’t (easily) do authentication, relying instead on .htaccess files and htpasswd. But I find myself wondering if I could set those up for localhost-only access on the server, and ssh-tunnel to the VPS, pointing my browser at the local tunnel port and things would just work without opening the server to the hordes of password-guessers by opening port 80.

Replies (2)

@jbcrawford@hachyderm.io 2026-05-06 22:46

@davepolaschek@writing.exchange I've done exactly this before, but you might be happier with a zero trust VPN approach like tailscale or manually with wireguard. Also see Pangolin which is probably too heavyweight for your situation but designed for exactly this kind of scenario.

Open ##2194076
@jrconlin@mindof.jrconlin.com 2026-05-07 03:36

@davepolaschek@writing.exchange You could. Essentially, you could create an ssh tunnel to the remote site (using something like ssh -D 8080 user@host, then use something like a SOCKS proxy on your local browser. (set to hit localhost:8080) I've done that plenty of times in the past with my box at home. That said, you're trading HTTP pokes for SSH ones. You can solve for both using things like fail2ban. That seriously helps manage traffic since the clowns get banned pretty fast.

Open ##2194078