Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup an ssh over https connection using nginx. I haven't found any working examples, so any help would be appreciated!

~$ cat .ssh/config
  ProtocolKeepAlives 30
  DynamicForward 8118
  ProxyCommand /usr/bin/proxytunnel -p -d localhost:22 -E -v -H "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)"

~$ ssh
Local proxy resolves to
Connected to (local proxy)

Tunneling to localhost:22 (destination)
Communication with local proxy:
 -> CONNECT localhost:22 HTTP/1.0
 -> Proxy-Connection: Keep-Alive
 -> User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
 <- <html>
 <- <head><title>400 Bad Request</title></head>
 <- <body bgcolor="white">
 <- <center><h1>400 Bad Request</h1></center>
 <- <hr><center>nginx/1.0.5</center>
 <- </body>
 <- </html>
analyze_HTTP: readline failed: Connection closed by remote host
ssh_exchange_identification: Connection closed by remote host

Nginx config on the server;

~$ cat /etc/nginx/sites-enabled/ssh 
upstream tunnel {
    server localhost:22;
server {
    listen 443;

    location / {
            proxy_pass http://tunnel;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_redirect off;

    ssl on;
    ssl_certificate /etc/ssl/certs/server.cer;
    ssl_certificate_key /etc/ssl/private/server.key;

~$ tail /var/log/nginx/access.log - - [08/Feb/2012:15:17:39 +1100] "CONNECT localhost:22 HTTP/1.0" 400 173 "-" "-"
share|improve this question

Nginx doesn't support forward proxy requests (the HTTP CONNECT method), which is why you get the "Bad request" response from Nginx. Proxytunnel is able to connect to Nginx, but from there it stops. AFAIF the Nginx authors have no plans to support forward proxy requests, as they like to be specialized in serving HTTP really well. Apache has modules for everything else, giving you the freedom to use those exotic features.

You can look at sslh, which can multiplex the incoming traffic at port 443 to either Nginx (listening at, SSH or OpenVPN. Make sure you let sslh listen at the public IP address, and not on as that overlaps with where Nginx is listening.

Another options is using Squid, but I have no experience there.

share|improve this answer

I've never seen this kind of setup and I doubt that it can work, because nginx expects to be able to treat the incoming connection as HTTP and talk to the upstream with HTTP. Why do you want to proxy through nginx?

share|improve this answer
It should be possible - proxytunnel is used to tunnel SSH sessions through HTTP(S) proxies, Here is the setup to configure this using apache – Thermionix Mar 26 '12 at 5:53
Apache seems to be operating as an actual HTTP proxy there, which I don't think that nginx supports (only reverse proxying). – mgorven Mar 26 '12 at 17:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.