Yves Rutschle

No love for sslh? “ Probes for HTTP, TLS/SSL (including SNI and ALPN), SSH, OpenVPN, tinc, XMPP, SOCKS5, are implemented, and any other protocol that can be tested using a regular expression, can be recognised. A typical use case is to allow serving several services on port 443 (e.g. to connect to SSH from inside a corporate firewall, which almost never block port 443) while still serving HTTPS on that port.” https://www.rutschle.net/tech/sslh/README.html

I have been using sslh (http://www.rutschle.net/tech/sslh.shtml) on my servers where it is just myself logging in for a while and it works great for me!

That already has a (brutal) solution now - sslh https://www.rutschle.net/tech/sslh/README.html - the current version is more sophisticated, but it was originally just a perl script that would send the connection to sshd or the https web server, based on regex matching on an initial string (and I probably timing out and going to sshd if it didn't see one? Something like that, I haven't dug out the old code to check.)

You will like this one as well “SSL/SSH Multiplexer” http://www.rutschle.net/tech/sslh/

Fixed link: https://www.rutschle.net/tech/sslh/README.html Note that while this is a handy tool, its use is apparent to anyone observing the connection.

> if the server is also hosting some https website, then put it on an alternate ipv6 address (they are free if not cheap) and ssh into that. There's also sslh, which can multiplex the same port by detecting whether the incoming connection is TLS or SSH, and forwarding appropriately. It's pretty cool: https://www.rutschle.net/tech/sslh/README.html That said, I think this service is for people who need to use computers without ssh clients installed locally.

Sslh would give you this ability, if you're prepared to shim an extra program infront of your daemon; http://www.rutschle.net/tech/sslh.shtml

Or use the good old sslh: http://www.rutschle.net/tech/sslh.shtml

It's a nice idea, but far from the only implementation. sslh is nice as it doesn't need go, and is packaged for most distros: http://www.rutschle.net/tech/sslh.shtml

sslh [1] (which is packaged and included in may linux and BSD distributions) has grown to support HTTP, SSL, SSH, OpenVPN, tinc, XMPP from the same port. It claims it can be extended to filter anything that can match with a regex. What I find lacking lately is I've mostly wanted to extend the forwarding/routing of ssh connections based on username (or better by identity) to different VMs or hosts, but I have no idea how to achieve that at the moment (without creating dummy users on the sshd server). [1] http://www.rutschle.net/tech/sslh.shtml Github: https://github.com/yrutschle/sslh

> apt-cache search ssh http [...] sslh - ssl/ssh multiplexer http://www.rutschle.net/tech/sslh.shtml I mean, it's cool that you got the exercise of implementing this in Go and all, but I don't see what's new and interesting about it. (and another implementation in Perl almost 4 years ago: https://news.ycombinator.com/item?id=2395787) Edit: oh whoops, didn't get to OP's "Why not sslh" section :\ "The result is useful in its own right through use of Go's interfaces for protocol matching (making adding new protocols trivial), and lightweight goroutines (instead of forking, which is more CPU intensive under load)." Well alright, the first point I'll concede, though I'm wary of the "reinvented wheel" scent, the second point I'm even more uncomfortable with as I think it makes wild assumptions of the kind of environment this tool could be useful in.

sslh[1] usually allows you to reach it even through fairly restrictive firewalls. At least unless they have their certs installed and inspect ssl traffic. [1] http://www.rutschle.net/tech/sslh.shtml

Here is a better idea. If it looks like a duck, walks like a duck and quacks like a duck, is it a duck? Run ssh on port 443 at the same time you run a web server on the same port. http://www.rutschle.net/tech/sslh.shtml I've seen implementatios in about a page of C, which I can vet.

Something similar, written in C is sslh[1]. [1]: http://www.rutschle.net/tech/sslh.shtml

Even better: Use SSLH[1], so you can still have an HTTPS server, but also connect to ssh on port 443. Set it up myself and my boss still doesn't know.. :) [1]: http://www.rutschle.net/tech/sslh.shtml

This is interesting but incomplete. It may not survive to deep packet inspection or rate limiting. Even worse - your only S3 machine could get blacklisted, and I don't see why operators wouldn't share blacklist the way it's done to fight spam. So my suggestion is to have multiple alternatives instead, as in lines of defense. First, a simple SSH server also running a socks and a http proxy is useful. Easy to reach and configure - some browser work better with http proxy (or was it sock? Opera only supports one but I can't remember which at the moment) In the second line, you want to run the SSH server on a nonstandard port as the author does. I suggest multiplexing the port : simply run SSLH on both port 80 and 443, with the patch published on http://rutschle.net/pipermail/sslh/2012-April/000202.html But that will not look like a standard SSL connection. Even worse, if you use your own certificate - operators could deny all self-signed certificates. So get stunnel running on port 443 with a "usual" certificate instead, and pass the traffic on port 80 where you'll be happy to have SSLH or whatever you prefer - like Openvpn which can do port sharing or which can be put "behind" stunnel and sslh, so that you will use a standard 443 port, and do a genuine SSL connection on that port. Much better. Have some fun with burst.net - they offer you 2 IP for like $7/month : you can do some routing and give the 2nd IP address to your laptop on the other end of the tunnel. Now that is…

If they're proxying HTTP traffic usually they'll block SSH and other protocols. To work around this use an HTTPS/SSH multiplexer[1][2][3] or a simple reverse proxy to accept HTTP[S] connections and connect them to an SSH server on the backend. For the ssh client use a ProxyCommand tunneling app[4][5][6] to turn an HTTP[S] proxy request into a two-way socket, and you have an SSH connection over HTTP proxies. [1] http://www.rutschle.net/tech/sslh.shtml [2] http://www.pond-weed.com/multiplex/ [3] https://github.com/stealth/sshttp [4] http://zwitterion.org/software/ssh-https-tunnel/ssh-https-tunnel [5] http://proxytunnel.sourceforge.net/ [6] http://www.agroman.net/corkscrew/