2

until few days ago I was able to connect to my remote ssh server, using corkscrew to tunnel the connection through the corporate proxy, with this simple configuration:

ssh -v root@xxx.xxx.xxx.xxx -p 443 -o "ProxyCommand corkscrew corp-proxy 8080 xxx.xxx.xxx.xxx 443"

I already set the ssh servers port on 443, because of corporate proxy limitations. Now, something has changed proxy side, and I receive this error:

OpenSSH_6.2p2 Ubuntu-6ubuntu0.4, OpenSSL 1.0.1e 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Executing proxy command: exec corkscrew corp-proxy 8080 xxx.xxx.xxx.xxx 443 
debug1: identity file /home/pe/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/user/.ssh/id_rsa-cert type -1
debug1: identity file /home/user/.ssh/id_dsa type -1
debug1: identity file /home/user/.ssh/id_dsa-cert type -1
debug1: identity file /home/user/.ssh/id_ecdsa type -1
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2p2 Ubuntu-6ubuntu0.4
debug1: permanently_drop_suid: 1000
ssh_exchange_identification: Connection closed by remote host

I tried also to install a new debian virtual machine, because my suspect is that I'm in someway blacklisted (my ip is fixed and assigned from dhcp by pc hostname).

From the new virtual machine my ip is randomly assigned by dhcp and if I try to connect I get a different response:

OpenSSH_6.0p1 Debian-4+deb7u2, OpenSSL 1.0.1e 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Executing proxy command: exec corkscrew corp-proxy 8080 xxx.xxx.xxx.xxx 443
debug1: permanently_drop_suid: 1000
debug1: identity file /home/user/.ssh/id_rsa type -1
debug1: identity file /home/user/.ssh/id_rsa-cert type -1
debug1: identity file /home/user/.ssh/id_dsa type -1
debug1: identity file /home/user/.ssh/id_dsa-cert type -1
debug1: identity file /home/user/.ssh/id_ecdsa type -1
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.0p1 Debian-4
debug1: match: OpenSSH_6.0p1 Debian-4 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2
debug2: fd 5 setting O_NONBLOCK
debug2: fd 4 setting O_NONBLOCK
debug3: put_host_port: [xxx.xxx.xxx.xxx]:443
debug1: SSH2_MSG_KEXINIT sent
Connection closed by UNKNOWN

This connection reaches the ssh server, as I can see in auth.log file, but this is the response:

Did not receive identification string from xxx.xxx.xxx.xxx

Could be the new proxy settings block me? Any suggestion on how to make ssh work again?

EDIT: tried several methods, openvpn, apache redirection.. nothing works. Apache redirection also give same error:

    telnet corp-proxy 8080
Trying xxx.xxx.xxx.xxx...
Connected to corp-proxy.
Escape character is '^]'.
CONNECT myserver:443 HTTP/1.0

HTTP/1.0 200 Connection Established
Date: Wed, 29 Oct 2014 16:12:06 GMT
Via: 1.1 corp-proxy

CONNECT myserver:1443 HTTP/1.0
Connection closed by foreign host.

in this case myserver has apache on 443 port, and that is accepted from proxy, when apache redirects connection on port 1443 to ssh server.. I'm kicked out.

0

Found a solution and probably the cause.

I suspect that proxy side has been enabled some kind of deep packet inspection (DPI) on 443 port, so only the "real" https requests can be accepted by proxy, all the other requests get a connection reset.

The solution is to use a program called Stunnel that is able to wrap the https request in a SSL container, so proxy side is indistinguishable from a normal https request (for example browsing a https site)

Stunnel must be installed server and client side, and can be configurated to use a proxy server to make requests.

There are many tutorials on internet on how to install and configure it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.