3 ms·
Actually, one thing I've found useful is keeping an sshd listening on port 443. I know, I know, sacrilege reusing the HTTPS port, right? The benefit of this i
by kenrose 13y ago
Actually, one thing I've found useful is keeping an sshd listening on port 443. I know, I know, sacrilege reusing the HTTPS port, right?
The benefit of this is that it can allow you to tunnel through an HTTP proxy (e.g., like in a corporate environment). Many HTTP proxies only allow traffic through to port 80 and port 443. The benefit of ssh on port 443 is that if the proxy is handed a CONNECT verb, it will transparently just transmit data between your client and the remote server, irrespective of what that content is. In fact, this behaviour is what makes HTTPS remain secure when going through an HTTP proxy.
You can use this to tunnel ssh through an HTTP proxy. Putty supports this out of the box, but if you're using openssh, you'll need corkscrew also.
You can always try to tunnel to an ssh server on port 22, but most proxies will hand you HTTP403 on any CONNECT request to a non-port 443.
More info at http://daniel.haxx.se/docs/sshproxy.html http://daniel.haxx.se/docs/sshproxy.html.
- XorNot 13y agoI use sshttp for this - support for both port HTTP and HTTPS. I don't serve any webpages, but I wanted the option to also use a more aggressive SSH holepunch on the same port, and just naked SSH if I could.
- antocv 13y ago> Many HTTP proxies only allow traffic through to port 80 and port 443. The benefit of ssh on port 443 is that if the proxy is handed a CONNECT verb, Thats not how HTTPS works, there is no HTTP proxy for 443. You are in a corporate environment where nothing is let out on port 80, except through their HTTP proxy. However, port 443 is allowed out. > In fact, this behaviour is what makes HTTPS remain secure when going through an HTTP proxy. That would be a MITM against https and it doenst work that way. If you would go over the http proxy to connect to your sshd on port 443, that would be stupid as the proxy would see your connections. Its much easier and better to just connect directly without asking the proxy.
- grahamedgecombe 13y agoIt can work like this - see: http://wiki.squid-cache.org/Features/HTTPS#CONNECT_tunnel http://wiki.squid-cache.org/Features/HTTPS#CONNECT_tunnel
- kenrose 13y agoRight. Sorry, in case I wasn't clear, the HTTP proxy acts as a proxy for HTTP on port 80, but tunnels HTTPS traffic (and anything else including ssh) on port 443. The tunnelling is done using the HTTP CONNECT verb.