ssh through authentication requiring proxy

Question

At work we have of course a company's-proxy. I need to ssh to some machines out of the company's network. The proxy, though, requires authentication.

Let's assume we have the following variables:

proxy_user="<username I need to authenticate at the proxy>"
proxy_pass="<password I need to authenticate at the proxy>"
proxy_serv="<hostname of the proxy>"
proxy_port=<port of the proxy>
ssh_user="<remote username I need to login on the ssh-machine>"
ssh_serv="<remote password I need to login on the ssh-machine>"
ssh_port=<ssh-port>

When setting the env-variable http_proxy and https_proxy as follows, tools like wget work fine (on the remote server, there is also a web_server installed):

$ export env http_proxy="http://$proxy_user:$proxy_pass@$proxy_serv:$proxy_port"

$ wget $ssh_serv
Connecting to <proxy_serv>... connected.
Proxy request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: ‘index.html’

But with ssh it does not work:

$ ssh $ssh_user@$ssh_server:$ssh_port
ssh: Could not resolve hostname <ssh_server>:<ssh_port> Temporary failure in name resolution

After googl-ing a little, I found out, that ssh needs a "ProxyCommand".  "nc" is not longer recommended here; "ssh -W" shall be used.  But I couldn't find an example where authentication was needed.  I tried so far:

ssh -o "ProxyCommand='ssh -W %h:%p $proxy_user:$proxy_pass@$proxy_serv:$proxy_port'" $ssh_user@$ssh_serv:$ssh_port

I guess I'm missing something somewhere, but couldn't find a good hint (neither in the manuals, nor on Google).

I hope that some of you guys might help me out.

Answer 1

Now after hours of googling I finally got it working for me with help of "corkscrew". My ssh-server is running currently on Port 443 (haven't tried yet, whether it would be possible on 22 as well).

~/.ssh/config

Host <my.ssh.server>
    ProxyCommand corkscrew <my.companies.proxy> <proxy.port> %h %p ~/corkscrew-auth

~/.corkscrew-auth

<proxies.username>:<proxies.password>

Now I was able to connect to my server via:

ssh <remote.user>@<my.ssh.server> -p 443

Answer 2

Just for a test - have you considered using nc anyway? When I would try to make proxy commands work, I was usually doing so at the config level: /root/.ssh/config

For example, the config would have the following:

Host ssh.example.com
    ProxyCommand ssh [email protected] nc %h %p

This is saying whenever you connect to ssh.example.com, it will use the ProxyCommand below. I suggest giving that a shot, if you absolutely can't use the netcat utility, I'm sure we can think of a workaround.

Answer 3

This is my solution for this:

First install this Debian/Ubuntu/Mint package:

apt-get install connect-proxy

Export credentials if you are working behind proxy with authentication:

export HTTP_PROXY_USER=<user>
export HTTP_PROXY_PASSWORD=<password>

Access ssh config file on /etc/ssh/ssh_config and set remote host port:

Port 443

Set server alive interval to avoid connection loss:

ServerAliveInterval 20

Set ProxyCommand to use the connect recently installed package:

ProxyCommand connect -H <proxy>:<port> %h %p

Close ssh config file, then you are ready to execute ssh connection:

ssh -N -D localhost:1080 <remoteuser>@<remotehost>

Open Firefox, configure Network Settings to only use Socket 5 with:

Host: localhost Port: 1080

Enable also Proxy DNS when using SOCKS v5.

Finally, in Firefox search tab, type the following:

about:config

Find network.proxy.allow_hijacking_localhost and set to true.

Now you are ready to connect behind proxy and use Firefox to explore behind created tunnel.