Tunneling SSH through Restrictive HTTS Proxy

In one of past articles I’ve described how to use HTTP CONNECT method to tunnel other protocols through a proxy.  It worked for me for various protocols ( mainly email access IMAP, SMTP),  but recently it stopped working for SSH protocol. After some investigation I’ve found  that proxy is checking  what protocol it is tunnelling through and expects it to be SSL/TLS.  If it is anything else, proxy closes connection with an error.  It still worked for mail protocols,  because they were already wrapped in SSL. But to be still able to use SSH through proxy some more sophisticated setup was needed –  tunnelling SSH through SSL protocol, which is then tunnelled via HTTPS proxy ( HTTP CONNECT method).  Below I describe a setup,  which works for me.

 Tools used

All tools could be installed from Ubuntu/Debian repositories via apt-get.

stunnel4 –   is a program that can wrap/unwrap any connection into/from SSL protocol
openssl – SSL utilities and SSL client
proxytunnel –  utility to tunnel connection through HTTPS proxy

 Sever Setup

On SSH server we have to install stunnel4 and openssl and configure it to accept SSL on some port and forward then unencrypted connection to local SSH server:

Here is configuration file stunnel.conf:

On Client Behind Proxy

We need to install proxytunnel here. Then following command will connect us to remote SSH server via HTTPS proxy:

And we can add proxy configuration to ~/.ssh/config:

And then connect easily just with short ssh command:

Possible Improvements

This article describes how to use haproxy to serve both HTTPS and SSH (tunneled in SSL) on same port, e.g. 443 – so service will look like normal secure web site.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code class="" title="" data-url=""> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong> <pre class="" title="" data-url=""> <span class="" title="" data-url="">