ssl and ssh multiplexing using sslh

Posted by Nico Golde in
Thursday, October 29. 2009

A lot of people used to configure their ssh servers to listen to a port different from 22 to prevent their logs getting filled with login attempts by script kiddies. I just stumbled over sslh which is a very nice alternative to that in case you have a webserver running which supports ssl. sslh is also a good choice if you are behind a corporate firewall and ssh is filtered while SSL is probably not (and this is simpler than tunneling).

The idea is pretty simple but cool. The daemon listens on port 443 and depending on whether the client has written something into the socket (SSL) or not (SSH) after connecting the daemon "forwards" the connection to the listening service running on the same host. In case of SSL/HTTPS the client will send a request after the handshake and in case of ssh it won't. Pretty simple. I just did a quick test on one of my hosts and it seems to work great. The tool is written in C, consists of < 500 SLOC and the code looks clean to me. If you're using Debian you can just apt-get install it.

Comments (6) - Trackbacks (0)

Defined tags for this entry: debian, software, ssh, tips, tools

Related entries by tags:

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

FWIW, a former DPL of ours posted a small C program for that a while ago. http://sam.zoy.org/blog/20070423-redirect.c
Sad it hadn't been improved to be a real program.

#1 glandium (Homepage) on 2009-10-29 17:14 (Reply)

seems both have been developed in parallel, at least sslh also started in 2007 from what I know.

#1.1 nion on 2009-10-29 18:13 (Reply)

When i looked for forwarder to have ssh and https on same port, i discovered this C implementation and decided to try to include it into Debian (RFP a few month ago). You're welcome to test it and report any bug you find into !

#2 Guillaume Delacour on 2009-10-29 20:06 (Reply)

works fine, nothing to complain

#2.1 nion on 2009-10-29 20:15 (Reply)

Annoying - I did something similar a couple of years ago:

http://sourceforge.net/projects/ssh-ssl-proxy/

It appears to use the same logic:
http://ssh-ssl-proxy.svn.sourceforge.net/viewvc/ssh-ssl-proxy/debian/0.3-1/README.html?revision=31

#3 Karl E. Jorgensen (Homepage) on 2009-10-29 20:29 (Reply)

"As with any other network-facing component, it is possible that bugs in ssh-ssl-proxy can be exploited to perform denial of service attacks, remote exploits or worse. ssh-ssl-proxy is deliberately being kept small to minimize this risk."

you're doing it wrong ;-P

#3.1 nion on 2009-10-30 00:57 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	Enclosing asterisks marks text as bold (word), underscore are made via _word_. Standard emoticons like :-) and ;-) are converted to images. You can use [geshi lang=lang_name [,ln={y\|n}]][/geshi] tags to embed source code snippets. E-Mail addresses will not be displayed and will only be used for E-Mail notifications To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above: You can use [geshi lang=lang_name [,ln={y\|n}]][/geshi] tags to embed source code snippets.
	Remember Information?