A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding
SSH port forwarding explained in a clean and visual way. How to use local and remote port forwarding. What sshd settings may need to be adjusted. How to memorize the right flags.
Explore the Catalog
Tutorials, challenges, courses, skill paths, playgrounds, and more — search the whole library in one place.
Harden Access to OpenClaw with Pomerium
by Nick Taylor
Put OpenClaw, a self-hosted AI assistant with shell and file access, behind a web route and an SSH route, both gated by the same identity and Pomerium's context-aware policy. OpenClaw runs in trusted-proxy mode, trusting signed identity headers instead of its own login, while Pomerium's native SSH proxy signs short-lived certificates for shell access.
Managing Podman Instances Remotely
by Shan Desai
Learn how you can control multiple podman instances on remote machines without SSHing into them manually. Also learn to deploy your Compose application stacks without SCP / SSH with podman remote feature and Docker Compose v2
Combining 2FA and Public Key Authentication for a better Linux SSH security
by med unes
Take a stock Debian SSH server and harden it the way you would in production: replace passwords with public-key auth, disable root login, add a TOTP second factor with PAM, and move off port 22, then prove it works by logging in, all inside the playground.
Turn Off a Feature Flag in a Production Redis Server Using a Local Containerized redis-cli
Ad-hoc containers are a handy way to run command-line tools without installing them on the host. Use one to access a production Redis server and turn off a feature flag. But beware of the gotcha: the production server can only be tunneled to the localhost.
Access a Private Kubernetes API Server Through an SSH SOCKS Proxy
The production Kubernetes cluster lives inside a private VPC, and its API server has no public endpoint. Turn an SSH connection to the bastion host into a SOCKS proxy and teach kubectl to use it, so the cluster becomes manageable from your workstation.
Challenge on Linux
SSH 101: Replace Password-Based Root Access with a Key-Based Admin Login
A newly provisioned server is reachable as root with a shared seed password. Create a sudoer admin user, switch SSH to key-based access, disable password and root logins, and retire the seed credential.
Reach a Remote Loopback Port Through an SSH Jump Host
An inventory service lives inside a private VPC and keeps its debugging port bound to 127.0.0.1. Use SSH local port forwarding with a jump-only bastion to query the debugging port from your workstation.
Master SSH Tunnels: Local and Remote Port Forwarding
Learn how to reach an internal port on a remote machine from the local system, jump through a bastion into a private VPC, expose a development server to the Internet through a reverse tunnel, publish a home network device, and spin up a full-fledged SOCKS proxy with nothing but a regular SSH connection.