[gentoo-user] [OT] Proxytunnel through nginx

[gentoo-user] [OT] Proxytunnel through nginx

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 2239 bytes --]

Hi All,

I am trying to set up a reverse-proxy at my home to be able to by-pass 
restrictive firewalls that only allow http/https traffic.

So I configured nginx as a reverse-proxy to send connections to the sshd at the 
home server.  However, I fail to establish a connection.  The connection 
attempt errors out with:

$ ssh root@192.168.1.5
SSL enabled
Connected to XXX.XX.XXX.XX:443 (local proxy)

Tunneling to 192.168.1.5:22 (destination)
Communication with local proxy:
 -> CONNECT 192.168.1.5:22 HTTP/1.0
 -> Proxy-Connection: Keep-Alive
analyze_HTTP: readline failed: Connection closed by remote host
ssh_exchange_identification: Connection closed by remote host

where XXX is the public IP address of my server.

the proxy tunnel command is as follows:

 /usr/bin/proxytunnel -v -e -p XXX.XX.XXX.XX:443 -R user:'secretpasswd' -d 
192.168.1.5:22

The relevant nginx entries are as follows:
================================
    upstream tunnel {
        server 127.0.0.1:22;
        }

    server {                                
        listen       443;
        server_name  localhost;

        ssl                  on;
        ssl_certificate      certs/cert.pem;   
        ssl_certificate_key  certs/cert.key;
        ssl_session_timeout  5m;
        keepalive_timeout       70;

        location /  {
                auth_basic      "Restricted";
                auth_basic_user_file    .htpasswd_slug;
#               proxy_pass http://tunnel;
                proxy_pass http://127.0.0.1;
                proxy_buffering off;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_redirect off;
        }
}
================================


The nginx error logs don't show anything, so I'm thinking there's something 
that the sshd does not like, but even when I increase the debug level in the 
sshd_config nothing shows up.  This means that the remote client never reaches 
as far as the sshd server (nginx and sshd are both running on the same host).

Any idea what causes this problem?

-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

[gentoo-user] Re: [OT] Proxytunnel through nginx

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 2628 bytes --]

On Sunday 19 Feb 2012 18:15:46 Mick wrote:
> Hi All,
> 
> I am trying to set up a reverse-proxy at my home to be able to by-pass
> restrictive firewalls that only allow http/https traffic.
> 
> So I configured nginx as a reverse-proxy to send connections to the sshd at
> the home server.  However, I fail to establish a connection.  The
> connection attempt errors out with:
> 
> $ ssh root@192.168.1.5
> SSL enabled
> Connected to XXX.XX.XXX.XX:443 (local proxy)
> 
> Tunneling to 192.168.1.5:22 (destination)
> Communication with local proxy:
>  -> CONNECT 192.168.1.5:22 HTTP/1.0
>  -> Proxy-Connection: Keep-Alive
> analyze_HTTP: readline failed: Connection closed by remote host
> ssh_exchange_identification: Connection closed by remote host
> 
> where XXX is the public IP address of my server.
> 
> the proxy tunnel command is as follows:
> 
>  /usr/bin/proxytunnel -v -e -p XXX.XX.XXX.XX:443 -R user:'secretpasswd' -d
> 192.168.1.5:22
> 
> The relevant nginx entries are as follows:
> ================================
>     upstream tunnel {
>         server 127.0.0.1:22;
>         }
> 
>     server {
>         listen       443;
>         server_name  localhost;
> 
>         ssl                  on;
>         ssl_certificate      certs/cert.pem;
>         ssl_certificate_key  certs/cert.key;
>         ssl_session_timeout  5m;
>         keepalive_timeout       70;
> 
>         location /  {
>                 auth_basic      "Restricted";
>                 auth_basic_user_file    .htpasswd_slug;
> #               proxy_pass http://tunnel;
>                 proxy_pass http://127.0.0.1;
>                 proxy_buffering off;
>                 proxy_set_header Host $host;
>                 proxy_set_header X-Real-IP $remote_addr;
>                 proxy_set_header X-Forwarded-For
> $proxy_add_x_forwarded_for; proxy_redirect off;
>         }
> }
> ================================
> 
> 
> The nginx error logs don't show anything, so I'm thinking there's something
> that the sshd does not like, but even when I increase the debug level in
> the sshd_config nothing shows up.  This means that the remote client never
> reaches as far as the sshd server (nginx and sshd are both running on the
> same host).
> 
> Any idea what causes this problem?

Could it be that the ssd does not like http/1.0 connections?

> Tunneling to 192.168.1.5:22 (destination)
> Communication with local proxy:
>  -> CONNECT 192.168.1.5:22 HTTP/1.0

Is it possible to configure a proxy connection from nginx without the http 
headers?
-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] [OT] Proxytunnel through nginx

[Helmut Jarausch]

On 02/19/2012 07:15:46 PM, Mick wrote:
> Hi All,
> 
> I am trying to set up a reverse-proxy at my home to be able to by-
> pass
> 
> restrictive firewalls that only allow http/https traffic.
> 

If you only want to get through your firewall by using the open port 
80, I'd use ssh's port forwarding capablities.

You might have a look at

https://help.ubuntu.com/community/SSH/OpenSSH/PortForwarding

You can use 'localhost' as "man in the middle".

Helmut.

Re: [gentoo-user] [OT] Proxytunnel through nginx

[Mick]

On 22 February 2012 12:07, Helmut Jarausch <jarausch@igpm.rwth-aachen.de> wrote:
> On 02/19/2012 07:15:46 PM, Mick wrote:
>> Hi All,
>>
>> I am trying to set up a reverse-proxy at my home to be able to by-
>> pass
>>
>> restrictive firewalls that only allow http/https traffic.
>>
>
> If you only want to get through your firewall by using the open port
> 80, I'd use ssh's port forwarding capablities.
>
> You might have a look at
>
> https://help.ubuntu.com/community/SSH/OpenSSH/PortForwarding
>
> You can use 'localhost' as "man in the middle".

Thanks Helmut.

This will only work if I set sshd at my home server to listen for
connections on port 443 or 80 (all other ports are blocked by the
gateway behind which I happen to be) and the gateway does not perform
deep packet inspection.

Hence, tunneling ssh via https is the only sure-fire way of getting
through restrictive firewalls and corporate internet gateways.

-- 
Regards,
Mick