ssh tunnel for 443

Question

I need get a file by a link (443), which is only possible from server B.

I have 3 servers, (A B C).

It is possible to access server B and download this file by wget from server C.

wget https://NAME:[email protected]/customerInfo/804-577823-10 --no-check-certificate
...
2021-06-18 16:18:01 (24,7 MB/s) - ‘804-577823-10’ saved [163/163]

From A to B, it is only allowed to use for port 22 (ssh), not port 443.

I need to make a tunnel, which will go through from A to B via 22 and download the file from C via wget port 443, exact the same way, as if I were on server B.

In short, I need a ssh tunnel from A to B and then I need to use port 443, for apply/download the file on C via wget from A, same way as on B.

I tried, but no success.

ssh -L 4433:C:443 -Nf B

I tried even with proxy, but no success.

wget -e use_proxy=yes -e http_proxy=C https://NAME:[email protected]/customerInfo/804-577823-10 --no-check-certificate

Is it possible?

Thank you.

UPDATE

SERVER_A:443 -> ssh tunnel by port 22 through SERVER_B -> SERVER_C:443

So if I use on SERVER_A same link as on SERVER_B, I want to get file by wget from SERVER_C.

Simplest way is allow port 443 on SERVER_C for SERVER_A, but it is not possible in this case.

Allowed is only port 22 between SERVER_A and SERVER_B.

It is clearest now?

Thanks.

Answer 1

It depends on who owns the servers in terms of permissions in order to determine what you are able to do. Also, what i do not quite understand is if this a one time download or you are in need of a permanent solution.

After reading your question I would go into server B with a secure shell.

$ ssh user@serverB

Then download the file from there. ( The point at the end is important)

$ scp -P 443 user@serverC:/path/to/file.txt  .

After this you can get send it to server A

$ scp file.txt user@serverA:~/

There are also more sophisticated solutions but it depends on your needs and freedom to act.

Update:

You can send a command to the server over ssh.

ssh user@serverB "wget your file at C"

You could do a double command like:

ssh user@serverB "wget your file @C:443  && scp file.txt you@serverA:~/"

But then you need to have serverB have his public certificates installed at serverA to go pass-wordless. The alternative is a 2 command script like explained above.

Answer 2

You can actually do this in one command by piping the output through your SSH connection. Assuming you are running this command from Server A, the following would work, I think.

$ ssh user@serverB "wget https://NAME:PASS@serverC/customerInfo/804-577823-10 --no-check-certificate -O -" > 804-577823-10.txt

This will connect to Server B, run the wget command to get content from Server C, and output it via STDOUT which is then captured in 804-577823-10.txt on Server A.

If you wanted to do this from a workstation outside of server A, you could also do the following:

$ ssh -J user@serverA user@serverB "wget https://NAME:PASS@serverC/customerInfo/804-577823-10 --no-check-certificate -O -" > 804-577823-10.txt

That will use server A as a jump box and then do the same thing as the previous command does. I also use -A for agent forwarding, which you might be able to use if your credentials are shared across the servers, so...

$ ssh -A -J user@serverA user@serverB "wget https://NAME:PASS@serverC/customerInfo/804-577823-10 --no-check-certificate -O -" > 804-577823-10.txt

Lastly, if you want to actually create a tunnel from server A to server C on port 443, you can do the following:

$ sudo -i # Required to bind to port 443.
# ssh user@serverB -T -N -L 127.1.2.3:443:serverC:443 &
# wget https://NAME:[email protected]/customerInfo/804-577823-10 --no-check-certificate
# kill -INT %1

Or if you'd rather not use root, you'll need to bind to a port higher than 1024, typically people use 10443. So...

$ ssh user@serverB -T -N -L 127.1.2.3:10443:serverC:443 &
$ wget https://NAME:[email protected]:10443/customerInfo/804-577823-10 --no-check-certificate
$ kill -INT %1

Also, when you're accessing an HTTP server via a tunnel, it's possible the HTTP server may only know how to access the content you are looking for by a fully-qualified domain name (FQDN). If so, you can add the parameter --header='Host: www.example.com' to your wget command to tell the server you are looking for content under that specific name.

Also note that you can bind to any 127.x.x.x address, which is useful if you're binding to a lot of different servers and you want to differentiate them more clearly. Typically what I do is replace the first octet of the device I am binding the destination to with 127, so, something like 10.194.27.18 would become 127.194.27.18. This will save you a lot of trouble if you're binding to multiple HTTP servers and want to prevent an overlap in cookies.

Hopefully this helps someone! I know the question is a bit dated.