3

I have a web daemon (listening on port 80 and 443) and a ssh daemon (listening on port 22) on the same machine.

I have a client (generating HTTP,HTTPS,SSH traffic) seating behind a proxy server (port 8080) and a firewall (only port 80 and 443 open).

I decided to use an HTTP tunnel for the SSH traffic through the proxy server and out. The problem is that the destination of that traffic is port 22 which is closed by the firewall.

I could use an HTTP tunnel with destination port 80 or 443 which is fine for the firewall but not for the destination server.

Is there any solution other than having 2 servers: 1 with the web server listening on port 80 and 443 and one with the ssh server listening on port 80 or 443 ?

Any advice would be greatly appreciated.

Laurent

3 Answers 3

5

I think a bit of a diagram may be in order here. You say that you've already setup an SSH over HTTP tunnel through the proxy server. Assuming you're running something on the remote server computer to handle terminating that SSH over HTTP tunnel you should be in business.

It sounds like you don't really have an SSH over HTTP proxy, if you're still trying to source connections out to the remote server, destination port 22.

Dag Wieers (of RPM repository fame) has written a HOWTO for tunneling SSH over HTTP(S). If your remote server is running Apache you should be able to pull off that configuration on your remote server.

I'm talking about doing this:

Diagram! (source: wellbury.com)

5
  • Even if I use SSH over HTTP, the final destination is still port 22 which is blocked by the firewall. I cannot have sshd listening on port 80 or 443 which is already used by the web server. I would prefer not to have all the SSH traffic going to the web server first, talk about bad performance. Sep 24, 2009 at 2:21
  • 1
    PS: I am using lighttpd for the web server. Sep 24, 2009 at 2:22
  • My edit that I'm dropping on in a moment will include a diagram. Clearly, we're not speaking about the same topology. Sep 24, 2009 at 6:06
  • 1
    Thanks for the diagram. What about if there is already a web server listening on port 443 and it cannot be used to receive SSH traffic. Sep 24, 2009 at 6:57
  • The link I included in my post, from Dag Wieers, describes configuring Apache to proxy traffic to SSH. You indicated you're using lighttpd. I have no experience with lighttpd, unfortunately. Looking at the wiki for the project it would appear that there is a patch (see redmine.lighttpd.net/issues/2060) that will add the necessary CONNECT behaviour to lighttpd to support proxying traffic to a sshd. You could, in theory, substitute your lighttpd install in where Dag uses Apache in his HOWTO. Sep 24, 2009 at 7:15
1

You'll need a second IP address to have an SSH daemon listening on port 80 or 443. The right answer, though, is to get the firewall fixed at the client end to allow appropriate traffic out. Tunneling everything over HTTP(S) is stupid, it turns the Internet into a two-port town.

7
  • 1
    I wish we could do that. Many enterprises don't open anything else than port 80 and 443. Sep 24, 2009 at 3:20
  • So fix that, then. Don't go stuffing everything down one port.
    – womble
    Sep 24, 2009 at 7:58
  • +1; Don't see why this was downvoted.
    – Dan Carley
    Sep 24, 2009 at 9:04
  • 2
    Because people don't like it when they're reminded of how they're screwing up the Internet.
    – womble
    Sep 24, 2009 at 9:29
  • I'd argue that it's their internet to screw up. Sep 24, 2009 at 13:20
1

Try to use multiplexing with

sslh

https://github.com/yrutschle/sslh/blob/master/README.md

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .