1

On one of my systems there is a firewall forbidding any outgoing unless http(s)...

Some users have to ssh but they can't.I tried first to run ssh on port 443 but with no success.

I googled it and found that I could do it using stunnel, which needs some configuration, so how to do that?

  • I think you should discuss this with your system admin. – Panther Feb 20 '14 at 16:19
3

This configuration is done in two parts. The first part is done on the remote SSH server. The second part is done on the local machine.

Server Side Instructions:

First install the stunnel:

sudo apt-get install stunnel4

Make the SSL certificate (for 365 days):

openssl genrsa 1024 > stunnel.key
openssl req -new -key stunnel.key -x509 -days 365 -out stunnel.crt
cat stunnel.crt stunnel.key > stunnel.pem
sudo mv stunnel.pem /etc/stunnel/

Configure stunnel to tunnel 443 (https) to 22 (ssh):

Create config file to meet the needs of using SSH over SSL.

gksu gedit /etc/stunnel/stunnel.conf

Write these:

pid = /var/run/stunnel.pid
cert = /etc/stunnel/stunnel.pem
[ssh] accept = public_ip:443
connect = 127.0.0.1:22

The above configuration tells stunnel where to find the certificate we generated and where to accept and forward connections. In this case stunnel will listen on the public_ip on port 443 (https) and redirect connections there back to localhost on 22 (ssh).

In order to start the stunnel service we’ll need to activate it in /etc/default/stunnel4. Change the ENABLED line from 0 to 1.

Finally, we can start the service and move on to the client configuration:

sudo service stunnel4 start

You can verify that stunnel is now listening by using the netstat command:

netstat -natp | grep :443

Client Side Instructions:

First install the stunnel package:

sudo apt-get install stunnel4

Make the SSL certificate (for 365 days):

openssl genrsa 1024 > stunnel.key
openssl req -new -key stunnel.key -x509 -days 365 -out stunnel.crt
cat stunnel.crt stunnel.key > stunnel.pem
sudo mv stunnel.pem /etc/stunnel/

Create config file :

gksu gedit /etc/stunnel/stunnel.conf

Write these:

pid = /var/run/stunnel.pid
cert = /etc/stunnel/stunnel.pem
[ssh] accept = 127.0.0.1:2200
connect = remote_ip:443

In order to start the stunnel service we’ll need to activate it in /etc/default/stunnel4. Change the ENABLED line from 0 to 1.

Start the service.

sudo service stunnel4 start

Make the connection

With the stunnel service now running on both the server and the client we’re ready to make the secure connection. Now when you connect to your local machine on port 2200 it will make a connection to the remote IP on port 443, create a secure SSL connection, and connect to port 22 on the other end. Your encrypted SSH connections are now wrapped in an encrypted SSL connection using port 443.

ssh localhost -p 2200

Sources: link1 Link2

2

stunnel is fine for permanent settings, but if you want a more ad hoc solution you can concatenate 2 tunnels.

In example, you want the host A to access the port 443 on host B but is blocked by firewall so you try to create a tunnel from host C who can access both A port 22 and B port 443

ssh -R 443:B:443 root@A won't work on Ubuntu or any dist that disable root account or root ssh access.

ssh -R 443:B:443 other_user@A won't work as only root can set up a listening port on A, even if user "other_user" has sudo allowance.

ssh -R 1443:B:443 other_user@A Will allow A to access B:443 using 127.0.0.1:1443. That's nice but sometimes you can not change the port (maybe port number it's hardcoded in an app).
In that case you can add another tunnel from A:443 to A:1443 using ssh -L 443:127.0.0.1:1443 127.0.0.1 in addition to the previous A->C->B tunnel.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.