68

I have a linux fedora21 client laptop behind a corporate firewall (which lets through http and https ports but not ssh 22) and I have a linux fedora21 server at home behind my own router. Browsing with https works when I specify my home server's public IP address (because I configured my home router)

Is it possible to ssh (remote shell) to my home server over the http/s port?

I saw a tool called corkscrew. would that help?

opensshd and httpd run on the home server. What else would need configuration?

9
  • 1
    put your sshd at home to listen on port 443, but you should disable port 443 on your home httpd.
    – taliezin
    Mar 16, 2015 at 13:30
  • I can't quite though that. I need httpd(s) for git pushed as well. so I gotta have a httpd listening on 443.
    – MMM
    Mar 16, 2015 at 13:43
  • try httptunnel - yum install httptunnel http://www.nocrew.org/software/httptunnel.html, or as you mentioned in your question: corkscrew.
    – taliezin
    Mar 16, 2015 at 13:46
  • Either way, sshd would listen to 22, and httpd to 80/443 and httptunnel or corkscrew would forward traffic httpd receives to sshd ?
    – MMM
    Mar 16, 2015 at 16:50
  • Yes. It don't have to change ports of your services.
    – taliezin
    Mar 16, 2015 at 18:16

3 Answers 3

Reset to default
71

What is possible depends on what the firewall allows.

If the firewall allows arbitrary traffic on port 443

Some firewalls take the simple way out and allow anything on port 443. If that's the case, the easiest way to reach your home server is to make it listen to SSH connections on port 443. If your machine is directly connected to the Internet, simply add Port 443 to /etc/ssh/sshd_config or /etc/sshd_config just below the line that says Port 22. If your machine is behind a router/firewall that redirects incoming connections, make it redirect incoming connections to port 443 to your server's port 22 with something like

iptables -t nat -I PREROUTING -p tcp -i wan0 --dport 443 -j DNAT --to-destination 10.1.2.3:22

where wan0 is the WAN interface on your router and 10.1.2.3 is your server's IP address on your home network.

If you want to allow your home server to listen both to HTTPS connections and SSH connections on port 443, it's possible — SSH and HTTPS traffic can easily be distinguished (in SSH, the server talks first, whereas in HTTP and HTTPS, the client talks first). See http://blog.stalkr.net/2012/02/sshhttps-multiplexing-with-sshttp.html and http://wrouesnel.github.io/articles/Setting%20up%20sshttp/ for tutorials on how to set this up with sshttp, and also Have SSH on port 80 or 443 while webserver (nginx) is running on these ports

If you have a web proxy that allows CONNECT tunnelling

Some firewalls block all outgoing connections, but allow browsing the web via a proxy that allows the HTTP CONNECT method to effectively pierce a hole in the firewall. The CONNECT method may be restricted to certain ports, so you may need to combine this with listening on port 443 as above.

To make SSH go via the proxy, you can use a tool like corkscrew. In your ~/.ssh/config, add a ProxyCommand line like the one below, if your web proxy is http://web-proxy.work.example.com:3128:

Host home
HostName mmm.dyndns.example.net
ProxyCommand corkscrew web-proxy.work.example.com 3128 %h %p

then you can connect by just running ssh home.

Wrapping SSH in HTTP(S)

Some firewalls don't allow SSH traffic, even on port 443. To cope with these, you need to disguise or tunnel SSH into something that the firewall lets through. See http://dag.wiee.rs/howto/ssh-http-tunneling/ for a tutorial on doing this with proxytunnel.

5
  • the 443 trick did it! I was surprised this works :) - any sysadmin sight why this seems to be the case with most firewalls?
    – AK_
    Dec 13, 2016 at 16:28
  • @AK_ Because although it's possible for a firewall to distinguish TLS from SSH, it's an additional configuration step and costs more in performance, for no real benefit when it comes to outgoing connections (since anything could be tunnelled in TLS anyway).
    – Gilles 'SO- stop being evil'
    Dec 13, 2016 at 16:31
  • @Gilles, Are there even proxy servers that block HTTPS yet allow HTTP CONNECT HTTPS?
    – Pacerier
    Oct 27, 2017 at 18:20
  • 1
    @Pacerier Many of them. It's not that the proxy blocks HTTPS — a proxy doesn't block connections that bypass the proxy — it's that direct connections are blocked, but the proxy allows CONNECT with any traffic provided that it's to port 443. There's no real way to filter HTTPS anyway, short of root of trust injection and certificate rewriting which is a very bad idea.
    – Gilles 'SO- stop being evil'
    Oct 27, 2017 at 19:30
  • Note you can also use netcat-openbsd instead of corkscrew in the proxy comand: ProxyCommand nc -X connect -x __proxy_IP__:__port__ %h %p
    – Paul Rougieux
    Jun 27, 2019 at 13:15
5

You can use sslh if you want to run BOTH an HTTPS server and an SSHd server on the same port 443.

3

you can try another way, set up a web server, which can ssh your server,

https://github.com/huashengdun/webssh

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .