1

At work we have of course a company's-proxy. I need to ssh to some machines out of the company's network. The proxy though requires authentication.

lets assume we have the following variables:

proxy_user="<username I need to authenticate at the proxy>"
proxy_pass="<password I need to authenticate at the proxy>"
proxy_serv="<hostname of the proxy>"
proxy_port=<port of the proxy>
ssh_user="<remote username I need to login on the ssh-machine>"
ssh_serv="<remote password I need to login on the ssh-machine>"
ssh_port=<ssh-port>

When setting the env-variable http_proxy and https_proxy as follows, tools like wget work fine (on the remote server, there is also an web_server installed):

$ export env http_proxy="http://$proxy_user:$proxy_pass@$proxy_serv:$proxy_port"

$ wget $ssh_serv
Connecting to <proxy_serv>... connected.
Proxy request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: ‘index.html’

But with ssh it does not work:

$ ssh $ssh_user@$ssh_server:$ssh_port
ssh: Could not resolve hostname <ssh_server>:<ssh_port> Temporary failure in name resolution

After googl-ing a little, I found out, that ssh needs an "ProxyCommand", whereas "nc" is not longer recommended, "ssh -W" shall be used. But I couldn't find an example, where authentification was needed. I tried so far:

ssh -o "ProxyCommand='ssh -W %h:%p $proxy_user:$proxy_pass@$proxy_serv:$proxy_port'" $ssh_user@$ssh_serv:$ssh_port

I guess I'm missing something somewhere, but couldn't find a good hint (neither in the manuals, nor on google).

I hope that some of you guys might help me out. Thanks in advance

  • This wiki mentions a new ProxyJump option. – meuh Jun 4 '18 at 14:32
  • IMHO you need socks proxy, not http – Romeo Ninov Jun 4 '18 at 15:16
  • @meuh: I have openssh_7.2 on my machine, which doesn't support -J option unfortunately – Tom Mekken Jun 5 '18 at 6:31
  • 1
    btw: I was able to connect to the remote server via FileZilla, through HTTP Proxy (used sftp protocol to my ssh-port). – Tom Mekken Jun 5 '18 at 6:32
0

Just for a test - have you considered using nc anyway? When I would try to make proxy commands work, I was usually doing so at the config level: /root/.ssh/config

For example, the config would have the following:

Host ssh.example.com
    ProxyCommand ssh root@proxy.example.com nc %h %p

This is saying whenever you connect to ssh.example.com, it will use the ProxyCommand below. I suggest giving that a shot, if you absolutely can't use the netcat utility, I'm sure we can think of a workaround.

  • i already tried the nc approach, but haven't had an idea for the authentication either. %h %p only refer to host and port. ssh_config(5) didn't tell anything about user and password – Tom Mekken Jun 4 '18 at 14:13
  • This command work when you use jump server (again ssh) as proxy. – Romeo Ninov Jun 4 '18 at 15:16
  • when i use the .ssh/config - approach, I get a name-resolution error, because he does not seem to understand, that he shall use the proxy for name resolution – Tom Mekken Jun 5 '18 at 6:29
0

Now after hours of googling I finally got it working for me with help of "corkscrew". My ssh-server is running currently on Port 443 (haven't tried yet, whether it would be possible on 22 as well).

~/.ssh/config

Host <my.ssh.server>
    ProxyCommand corkscrew <my.companies.proxy> <proxy.port> %h %p ~/corkscrew-auth

~/.corkscrew-auth

<proxies.username>:<proxies.password>

Now I was able to connect to my server via:

ssh <remote.user>@<my.ssh.server> -p 443

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.