#!/bin/sh ## This is what a simple SSH tunnel might look like: USER=avenj ENDPOINT=eris LOCALPORT=5511 REMOTEPORT=5511 ssh -f ${USER}@${ENDPOINT} \ -L ${LOCALPORT}:${REMOTEPORT} \ -N ## :<<'CMTBLK' ... then bind tcp:// and connect on the side running the tunnel. (You only want to do this if you control the systems involved, obviously.) SSH is a pretty convenient poor man's VPN, providing a secure way to talk to a remote ZMQ socket that is only bound to localhost. This is far more useful when combined with OpenSSH's certificate support -- see the 'CERTIFICATES' section of ssh-keygen(1): ## Create a CA cert -> $ ssh-keygen -f ca_key ## Trust this CA key for the server-side account: $ echo "cert-authority $(cat ca_key.pub)" >>~/.ssh/authorized_keys ## Create a user key on the client-side if one doesn't exist: % ssh-keygen -f some_user_key ## Retrieve and sign the user's pub key: $ ssh-keygen -s ca_key -I "Joe User" some_user_key.pub ## or with valid users specified: $ ssh-keygen -s ca_key -I "Joe User" -n joeuser some_user_key.pub Now you can easily add workers by signing their keys and allowing them to tunnel in to talk to ZMQ. CMTBLK