SSH via Corkscrew to a remote server not working

Question

I am trying to SSH to a remote server from my college network (proxy). However, I am getting this error whenever I try to SSH to the host

ssh_exchange_identification: Connection closed by remote host

Here is the complete description :-

Command :-

ssh -vvv root@serverIP -p serverPort

Output :-

OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /home/prashant/.ssh/config
debug1: /home/prashant/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Executing proxy command: exec /usr/bin/corkscrew 144.16.192.213 8080  serverIP serverPort
debug1: identity file /home/prashant/.ssh/id_rsa type -1
debug1: identity file /home/prashant/.ssh/id_rsa-cert type -1
debug1: identity file /home/prashant/.ssh/id_dsa type -1
debug1: identity file /home/prashant/.ssh/id_dsa-cert type -1
debug1: identity file /home/prashant/.ssh/id_ecdsa type -1
debug1: identity file /home/prashant/.ssh/id_ecdsa-cert type -1
debug1: permanently_drop_suid: 1000
ssh_exchange_identification: Connection closed by remote host

My config file contains this

Host *
ProxyCommand /usr/bin/corkscrew 144.16.192.213 8080  %h %p

Can anyone help me in solving this issue ?

Thanks !

Answer 1

I'm not completely sure my interpretation is correct, but I think this is what's happening.

The connection is blocked by the proxy. HTTP CONNECT (which is what corkscrew uses to bounce past the proxy) is necessary in typical configurations to browse HTTPS sites. The proxy cannot filter the connection since it's encrypted, and it has no choice but to let what looks vaguely like an SSL connection through. (SSL and SSH can actually be distinguished, but many proxies don't bother) However, almost all HTTPS sites are on the default port (443), so proxies often only bounce connections to port 443. I think “Connection closed by remote host” is due to the proxy dropping the connection when it sees that you're trying to bounce to a different port.

If you can, change the configuration of the SSH server so that it listens on port 443. “Proxy could not open connection to serverIP: Service Unavailable” indicates that the proxy is willing to let you connect, but there is no server listening on that port. (There's no guarantee that it won't do some form of traffic analysis and block you once the SSH protocol starts taking place.)

You need to be root on the target machine to make the server listen on port 443. If you aren't running an HTTPS server, it's as easy of adding the line Port 443 in the sshd_config file and restarting the sshd process (service ssh restart, /etc/init.d/ssh restart or some such command).

You can run both an SSH server and an HTTPS server on the same port, as the first packet sent by the client is enough to tell which one is requested. You can use the sslh multiplexer (see also this guide).