3

At work we have of course a company's-proxy. I need to ssh to some machines out of the company's network. The proxy, though, requires authentication.

Let's assume we have the following variables:

proxy_user="<username I need to authenticate at the proxy>"
proxy_pass="<password I need to authenticate at the proxy>"
proxy_serv="<hostname of the proxy>"
proxy_port=<port of the proxy>
ssh_user="<remote username I need to login on the ssh-machine>"
ssh_serv="<remote password I need to login on the ssh-machine>"
ssh_port=<ssh-port>

When setting the env-variable http_proxy and https_proxy as follows, tools like wget work fine (on the remote server, there is also a web_server installed):

$ export env http_proxy="http://$proxy_user:$proxy_pass@$proxy_serv:$proxy_port"

$ wget $ssh_serv
Connecting to <proxy_serv>... connected.
Proxy request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: ‘index.html’

But with ssh it does not work:

$ ssh $ssh_user@$ssh_server:$ssh_port
ssh: Could not resolve hostname <ssh_server>:<ssh_port> Temporary failure in name resolution

After googl-ing a little, I found out, that ssh needs a "ProxyCommand".  "nc" is not longer recommended here; "ssh -W" shall be used.  But I couldn't find an example where authentication was needed.  I tried so far:

ssh -o "ProxyCommand='ssh -W %h:%p $proxy_user:$proxy_pass@$proxy_serv:$proxy_port'" $ssh_user@$ssh_serv:$ssh_port

I guess I'm missing something somewhere, but couldn't find a good hint (neither in the manuals, nor on Google).

I hope that some of you guys might help me out.

6
  • This wiki mentions a new ProxyJump option.
    – meuh
    Jun 4, 2018 at 14:32
  • IMHO you need socks proxy, not http Jun 4, 2018 at 15:16
  • @meuh: I have openssh_7.2 on my machine, which doesn't support -J option unfortunately
    – Tom Mekken
    Jun 5, 2018 at 6:31
  • 1
    btw: I was able to connect to the remote server via FileZilla, through HTTP Proxy (used sftp protocol to my ssh-port).
    – Tom Mekken
    Jun 5, 2018 at 6:32
  • (1) Your first code block indicates that ssh_serv is your password.  Your second code block suggests that you are passing that value as a command-line argument to wget.  Is that really what you mean?  (2) export env abc="def" creates a phantom exported variable called “env”.  You should say just export abc="def".  (2b) There are obscure technical reasons why it might be better to say abc="def" and export abc as two separate commands (optionally, on the same line, separated by a semicolon), but the combined form is usually OK. … (Cont’d) Jul 8, 2022 at 18:53

3 Answers 3

1

Now after hours of googling I finally got it working for me with help of "corkscrew". My ssh-server is running currently on Port 443 (haven't tried yet, whether it would be possible on 22 as well).

~/.ssh/config

Host <my.ssh.server>
    ProxyCommand corkscrew <my.companies.proxy> <proxy.port> %h %p ~/corkscrew-auth

~/.corkscrew-auth

<proxies.username>:<proxies.password>

Now I was able to connect to my server via:

ssh <remote.user>@<my.ssh.server> -p 443
0

Just for a test - have you considered using nc anyway? When I would try to make proxy commands work, I was usually doing so at the config level: /root/.ssh/config

For example, the config would have the following:

Host ssh.example.com
    ProxyCommand ssh [email protected] nc %h %p

This is saying whenever you connect to ssh.example.com, it will use the ProxyCommand below. I suggest giving that a shot, if you absolutely can't use the netcat utility, I'm sure we can think of a workaround.

3
  • i already tried the nc approach, but haven't had an idea for the authentication either. %h %p only refer to host and port. ssh_config(5) didn't tell anything about user and password
    – Tom Mekken
    Jun 4, 2018 at 14:13
  • This command work when you use jump server (again ssh) as proxy. Jun 4, 2018 at 15:16
  • when i use the .ssh/config - approach, I get a name-resolution error, because he does not seem to understand, that he shall use the proxy for name resolution
    – Tom Mekken
    Jun 5, 2018 at 6:29
0

This is my solution for this:

First install this Debian/Ubuntu/Mint package:

apt-get install connect-proxy

Export credentials if you are working behind proxy with authentication:

export HTTP_PROXY_USER=<user>
export HTTP_PROXY_PASSWORD=<password>

Access ssh config file on /etc/ssh/ssh_config and set remote host port:

Port 443

Set server alive interval to avoid connection loss:

ServerAliveInterval 20

Set ProxyCommand to use the connect recently installed package:

ProxyCommand connect -H <proxy>:<port> %h %p

Close ssh config file, then you are ready to execute ssh connection:

ssh -N -D localhost:1080 <remoteuser>@<remotehost>

Open Firefox, configure Network Settings to only use Socket 5 with:

Host: localhost Port: 1080

Enable also Proxy DNS when using SOCKS v5.

Finally, in Firefox search tab, type the following:

about:config

Find network.proxy.allow_hijacking_localhost and set to true.

Now you are ready to connect behind proxy and use Firefox to explore behind created tunnel.

1
  • (1) Is it really necessary to put the password in the environment (in clear text)?  This is generally considered to be insecure.  (2) I assume that, when you say “<something>”, you mean it as a placeholder.  So what do you mean by <proxy>?  Do you mean proxy server hostname?  (3) What do you mean by “configure Connection settings to only use Socket 5 with host localhost (and) port 1080”? … … … … … … … … … … … … … … … … … … … … Please do not respond in comments; edit your answer to make it clearer and more complete. Jul 8, 2022 at 17:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .