TEXT   56

proxy2ssh allows you to ssh over a web proxy

Guest on 25th April 2022 12:07:25 PM

  1. proxy2ssh allows you to ssh over a web proxy using only GET/POST
  2. (not CONNECT) requests.
  3.  
  4. Background:
  5.  
  6. I've been using the http proxy CONNECT method for years to ssh through
  7. http proxies. In the early days I used to run a script from the local
  8. inetd server that would connect to the proxy server and sent the
  9. necessary preamble to connect to my home machine. Something like this:
  10.  
  11. #!/bin/bash
  12.  
  13. HOST=myserver.com
  14. PROXY=proxy.acme.com
  15. PROXY_PORT=8080
  16.  
  17. (
  18.  echo -en "CONNECT ${HOST}:443 HTTP/1.1\n"
  19.  echo -en "Host: ${HOST}:443\n"
  20.  echo -en "\r\n"
  21.  cat
  22. ) | (
  23.  nc ${PROXY} ${PROXY_PORT}
  24. ) | (
  25.  head -3 >/dev/null # eat unwanted proxy http headers
  26.  cat
  27. )
  28.  
  29.  
  30. Then I'd ssh -p 2222 localhost and the script would connect me to my
  31. home machine through the http proxy.
  32.  
  33. These days it's even easier; openssh's ssh client has an option
  34. -oProxyCommand that will let you run the proxy script directly from ssh
  35. (instead of having to run it from inetd):
  36.  
  37. ssh -oProxyCommand=proxy.sh user@host
  38.  
  39. There are actually several programs for doing this now. proxytunnel,
  40. ssh-https-tunnel, corkscrew and probably many others. None of them really
  41. do anything different than the above shell script. They all use CONNECT.
  42.  
  43. On some proxies CONNECT just isn't available or is restricted to a
  44. limited number of whitelisted hosts and ports. The ports problem is
  45. usually easy to overcome by making sshd listen on port 443 (as I did for
  46. the old shell script above). If CONNECT is enabled at all it will
  47. normally be allowed for 443 as that is the https port which is the
  48. reason d'etre for CONNECT in the first place. Normally regular HTTP
  49. GET/POST are less restricted and can often connect to pretty much
  50. anywhere.

Raw Paste

Login or Register to edit or fork this paste. It's free.