FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Gentoo > Gentoo User

 
 
LinkBack Thread Tools
 
Old 02-19-2012, 05:15 PM
Mick
 
Default Proxytunnel through nginx

Hi All,

I am trying to set up a reverse-proxy at my home to be able to by-pass
restrictive firewalls that only allow http/https traffic.

So I configured nginx as a reverse-proxy to send connections to the sshd at the
home server. However, I fail to establish a connection. The connection
attempt errors out with:

$ ssh root@192.168.1.5
SSL enabled
Connected to XXX.XX.XXX.XX:443 (local proxy)

Tunneling to 192.168.1.5:22 (destination)
Communication with local proxy:
-> CONNECT 192.168.1.5:22 HTTP/1.0
-> Proxy-Connection: Keep-Alive
analyze_HTTP: readline failed: Connection closed by remote host
ssh_exchange_identification: Connection closed by remote host

where XXX is the public IP address of my server.

the proxy tunnel command is as follows:

/usr/bin/proxytunnel -v -e -p XXX.XX.XXX.XX:443 -R user:'secretpasswd' -d
192.168.1.5:22

The relevant nginx entries are as follows:
================================
upstream tunnel {
server 127.0.0.1:22;
}

server {
listen 443;
server_name localhost;

ssl on;
ssl_certificate certs/cert.pem;
ssl_certificate_key certs/cert.key;
ssl_session_timeout 5m;
keepalive_timeout 70;

location / {
auth_basic "Restricted";
auth_basic_user_file .htpasswd_slug;
# proxy_pass http://tunnel;
proxy_pass http://127.0.0.1;
proxy_buffering off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_redirect off;
}
}
================================


The nginx error logs don't show anything, so I'm thinking there's something
that the sshd does not like, but even when I increase the debug level in the
sshd_config nothing shows up. This means that the remote client never reaches
as far as the sshd server (nginx and sshd are both running on the same host).

Any idea what causes this problem?

--
Regards,
Mick
 
Old 02-22-2012, 06:14 AM
Mick
 
Default Proxytunnel through nginx

On Sunday 19 Feb 2012 18:15:46 Mick wrote:
> Hi All,
>
> I am trying to set up a reverse-proxy at my home to be able to by-pass
> restrictive firewalls that only allow http/https traffic.
>
> So I configured nginx as a reverse-proxy to send connections to the sshd at
> the home server. However, I fail to establish a connection. The
> connection attempt errors out with:
>
> $ ssh root@192.168.1.5
> SSL enabled
> Connected to XXX.XX.XXX.XX:443 (local proxy)
>
> Tunneling to 192.168.1.5:22 (destination)
> Communication with local proxy:
> -> CONNECT 192.168.1.5:22 HTTP/1.0
> -> Proxy-Connection: Keep-Alive
> analyze_HTTP: readline failed: Connection closed by remote host
> ssh_exchange_identification: Connection closed by remote host
>
> where XXX is the public IP address of my server.
>
> the proxy tunnel command is as follows:
>
> /usr/bin/proxytunnel -v -e -p XXX.XX.XXX.XX:443 -R user:'secretpasswd' -d
> 192.168.1.5:22
>
> The relevant nginx entries are as follows:
> ================================
> upstream tunnel {
> server 127.0.0.1:22;
> }
>
> server {
> listen 443;
> server_name localhost;
>
> ssl on;
> ssl_certificate certs/cert.pem;
> ssl_certificate_key certs/cert.key;
> ssl_session_timeout 5m;
> keepalive_timeout 70;
>
> location / {
> auth_basic "Restricted";
> auth_basic_user_file .htpasswd_slug;
> # proxy_pass http://tunnel;
> proxy_pass http://127.0.0.1;
> proxy_buffering off;
> proxy_set_header Host $host;
> proxy_set_header X-Real-IP $remote_addr;
> proxy_set_header X-Forwarded-For
> $proxy_add_x_forwarded_for; proxy_redirect off;
> }
> }
> ================================
>
>
> The nginx error logs don't show anything, so I'm thinking there's something
> that the sshd does not like, but even when I increase the debug level in
> the sshd_config nothing shows up. This means that the remote client never
> reaches as far as the sshd server (nginx and sshd are both running on the
> same host).
>
> Any idea what causes this problem?

Could it be that the ssd does not like http/1.0 connections?

> Tunneling to 192.168.1.5:22 (destination)
> Communication with local proxy:
> -> CONNECT 192.168.1.5:22 HTTP/1.0

Is it possible to configure a proxy connection from nginx without the http
headers?
--
Regards,
Mick
 
Old 02-22-2012, 11:07 AM
Helmut Jarausch
 
Default Proxytunnel through nginx

On 02/19/2012 07:15:46 PM, Mick wrote:
> Hi All,
>
> I am trying to set up a reverse-proxy at my home to be able to by-
> pass
>
> restrictive firewalls that only allow http/https traffic.
>

If you only want to get through your firewall by using the open port
80, I'd use ssh's port forwarding capablities.

You might have a look at

https://help.ubuntu.com/community/SSH/OpenSSH/PortForwarding

You can use 'localhost' as "man in the middle".

Helmut.
 
Old 02-22-2012, 01:20 PM
Mick
 
Default Proxytunnel through nginx

On 22 February 2012 12:07, Helmut Jarausch <jarausch@igpm.rwth-aachen.de> wrote:
> On 02/19/2012 07:15:46 PM, Mick wrote:
>> Hi All,
>>
>> I am trying to set up a reverse-proxy at my home to be able to by-
>> pass
>>
>> restrictive firewalls that only allow http/https traffic.
>>
>
> If you only want to get through your firewall by using the open port
> 80, I'd use ssh's port forwarding capablities.
>
> You might have a look at
>
> https://help.ubuntu.com/community/SSH/OpenSSH/PortForwarding
>
> You can use 'localhost' as "man in the middle".

Thanks Helmut.

This will only work if I set sshd at my home server to listen for
connections on port 443 or 80 (all other ports are blocked by the
gateway behind which I happen to be) and the gateway does not perform
deep packet inspection.

Hence, tunneling ssh via https is the only sure-fire way of getting
through restrictive firewalls and corporate internet gateways.

--
Regards,
Mick
 

Thread Tools




All times are GMT. The time now is 07:19 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org