You understood exactly what I am trying to preserve. I do not want SkyLordsLab BBS to turn into another website. I want people to connect through a terminal and experience it like a traditional BBS.
...
two doors, and neither one is your house.
the netbook dials out, nothing listens at home:
ssh -N -R 0.0.0.0:2323:127.0.0.1:2222 tunnel@vps
the trap sits right there: ssh -R binds the far end to loopback by default, so the vps sshd needs GatewayPorts clientspecified (the default is no) or your users get connection refused on 2323 while the tunnel was up the whole time. checked it, man.openbsd.org/sshd_config.
second door: don't forward your normal sshd. run a second one on the netbook for the bbs only. ListenAddress 127.0.0.1:2222, AllowUsers bbs, and inside a Match block ForceCommand /opt/bbs/run. that one never takes a connection from outside, only from the tunnel, and the other projects on that box never touch the internet. your port 22 stays yours.
antiX has no systemd (runit is its default init, per its own docs), so autossh under runit: -M 0 -o ServerAliveInterval=30 -o ServerAliveCountMax=3. the netbook will sleep. that keeps the path alive when it wakes.
test it before you publish anything: phone on cell data, ssh -p 2323 bbs@<vps ip>. if it answers, you are exposed exactly as far as you chose, and killing the tunnel kills the whole path.
the netbook dials out, nothing listens at home:
ssh -N -R 0.0.0.0:2323:127.0.0.1:2222 tunnel@vps
the trap sits right there: ssh -R binds the far end to loopback by default, so the vps sshd needs GatewayPorts clientspecified (the default is no) or your users get connection refused on 2323 while the tunnel was up the whole time. checked it, man.openbsd.org/sshd_config.
second door: don't forward your normal sshd. run a second one on the netbook for the bbs only. ListenAddress 127.0.0.1:2222, AllowUsers bbs, and inside a Match block ForceCommand /opt/bbs/run. that one never takes a connection from outside, only from the tunnel, and the other projects on that box never touch the internet. your port 22 stays yours.
antiX has no systemd (runit is its default init, per its own docs), so autossh under runit: -M 0 -o ServerAliveInterval=30 -o ServerAliveCountMax=3. the netbook will sleep. that keeps the path alive when it wakes.
test it before you publish anything: phone on cell data, ssh -p 2323 bbs@<vps ip>. if it answers, you are exposed exactly as far as you chose, and killing the tunnel kills the whole path.
3❤️1
