I'm trying to SSH to a remote server through an HTTP proxy using corkscrew and the following stanza in ~/.ssh/config:

Host target
  ProxyCommand corkscrew proxy 80 remote.host.ip 443 ~/.ssh/proxyauth

where; "proxy 80" is the dns name and port of the HTTP proxy, my ssh server is configured to listen on port 443 of remote.host.ip and the proxyauth file contains "user:password" required to access the HTTP proxy.

I get the following on the client;

$ ssh target
ssh_exchange_identification: Connection closed by remote host

and on the server, in /var/log/auth.log I get;

Mar 12 13:16:32 hostname sshd[16029]: Did not receive identification string from x.x.x.x

It looks as though the SSH client (OpenSSH) doesn't initiate the protocol correctly, or that the proxy somehow mangles it and the server then closes the connection.

Things I've tried and eliminated are;

  1. Running corkscrew directly on the client machine using the same parameters as in the ~/.ssh/config ProxyCommand. This works, and I see the server's SSH banner advertising protocol and version information. So basic connectivity through the HTTP proxy works and the SSHD is definitely reachable (also proved by seeing log entries on the server).

  2. Tested the client's key pair against the same server, but from a host not requiring a proxy. This works fine, so the key pair is OK.

  3. Increased the logging on both ends of the SSH, results shown;

client...

$ ssh -vvv target
OpenSSH_6.2p2, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /home/davisond/.ssh/config
debug1: /home/davisond/.ssh/config line 3: Applying options for home
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 50: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Executing proxy command: exec corkscrew proxy 80 remote.host.ip 443 ~/.ssh/proxyauth
debug3: Incorrect RSA1 identifier
debug3: Could not load "/home/davisond/.ssh/id_rsa" as a RSA1 public key
debug1: permanently_drop_suid: 1000
debug1: identity file /home/davisond/.ssh/id_rsa type 1
debug1: identity file /home/davisond/.ssh/id_rsa-cert type -1
debug1: identity file /home/davisond/.ssh/id_dsa type -1
debug1: identity file /home/davisond/.ssh/id_dsa-cert type -1
debug1: identity file /home/davisond/.ssh/id_ecdsa type -1
debug1: identity file /home/davisond/.ssh/id_ecdsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
ssh_exchange_identification: Connection closed by remote host

and on the server;

Mar 12 13:23:49 hepburn sshd[20786]: debug1: Forked child 20997.
Mar 12 13:23:49 hepburn sshd[20997]: Set /proc/self/oom_score_adj to 0
Mar 12 13:23:49 hepburn sshd[20997]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8
Mar 12 13:23:49 hepburn sshd[20997]: debug1: inetd sockets after dupping: 3, 3
Mar 12 13:23:49 hepburn sshd[20997]: Connection from x.x.x.x port 22104
Mar 12 13:23:49 hepburn sshd[20997]: Did not receive identification string from x.x.x.x

Anyone offer pointers as to where to go from here to make this work?

  • i'm using the following syntax and it work "ProxyCommand corkscrew proxy.example.com 8080 %h %p" – c4f4t0r Mar 12 '14 at 13:59
  • It's just a variation on the same, with that you define the Host and Port params in the same stanza, but it does the same thing and gives the same result. I think, actually, the proxy is doing some sort of packet analysis and dropping the connection either because it can tell that it isn't SSL/TLS or because it specifically sees that it's SSH. Either way, not sure if there's a further workaround to this unless SSH can disguise itself as an SSL exchange. – darrend Mar 13 '14 at 15:05

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.