forked from yrutschle/sslh
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Changed log format to make it possible to link connections to subsequent logs from other services. Updated CentOS init.d script (Andre Krajnik). Fixed zombie issue with OpenBSD (The SA_NOCLDWAIT flag is not propagated to the child process, so we set up signals after the fork.) (François FRITZ) Added -o "OpenVPN" and OpenVPN probing and support. Added single-threaded, select(2)-based version. Added support for "Bold" SSH clients (clients that speak first) Thanks to Guillaume Ricaud for spotting a regression bug. Added -f "foreground" option. Added test suite. (only tests connexions. No test for libwrap, setsid, setuid and so on) and corresponding 'make test' target. Added README.MacOSX (thanks Aaron Madlon-Kay) Documented use with proxytunnel and corkscrew in README.
- Loading branch information
Showing
12 changed files
with
1,683 additions
and
555 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,42 +1,42 @@ | ||
| ===== sslh -- A ssl/ssh multiplexer. ===== | ||
|
|
||
| sslh lets one accept both HTTPS and SSH connections on the | ||
| same port. It makes it possible to connect to an SSH server | ||
| on port 443 (e.g. from inside a corporate firewall) while | ||
| still serving HTTPS on that port. | ||
| sslh accepts HTTPS, SSH and OpenVPN connections on the same | ||
| port. This makes it possible to connect to an SSH server or | ||
| an OpenVPN on port 443 (e.g. from inside a corporate | ||
| firewall, which almost never block port 443) while still | ||
| serving HTTPS on that port. | ||
|
|
||
| ==== Compile and install ==== | ||
|
|
||
| If you're lucky, the Makefile will work for you: | ||
|
|
||
| make install | ||
|
|
||
| (see below for configuration hints) | ||
| The Makefile produces two different executables: sslh-fork | ||
| and sslh-select. | ||
|
|
||
| sslh-fork forks a new process for each incoming connection. | ||
| It is well-tested and very reliable, but incurs the overhead | ||
| of many processes. sslh-select uses only one thread, which | ||
| monitors all connections at once. It is more recent and less | ||
| tested, but only incurs a 16 byte overhead per connection. | ||
| Also, if it stops, you'll lose all connections, which means | ||
| you can't upgrade it remotely. | ||
|
|
||
| Otherwise: | ||
| If you are going to use sslh for a "small" setup (less than | ||
| a dozen ssh connections and a low-traffic https server) then | ||
| sslh-fork is probably more suited for you. If you are going | ||
| to use sslh on a "medium" setup (a few thousand ssh | ||
| connections, and another few thousand sslh connections), | ||
| sslh-select will be better. If you have a very large site | ||
| (tens of thousands of connections), you'll need a vapourware | ||
| version that would use libevent or something like that. | ||
|
|
||
| Compilation instructions (the binary produced won't contain | ||
| the version number, which is stored only in the Makefile) | ||
|
|
||
| Solaris: | ||
| cc -o sslh sslh.c -lresolv -lsocket -lnsl | ||
|
|
||
| LynxOS: | ||
| gcc -o tcproxy tcproxy.c -lnetinet | ||
|
|
||
| Linux: | ||
| cc -o sslh sslh.c -lnet | ||
| or: | ||
| cc -o sslh sslh.c | ||
|
|
||
| To compile with libwrap support: | ||
| cc -o sslh -DLIBWRAP sslh.c -lwrap | ||
|
|
||
| To install: | ||
|
|
||
| make | ||
| cp sslh /usr/local/sbin | ||
| cp sslh-fork /usr/local/sbin/sslh | ||
| cp scripts/etc.default.sslh /etc/default/sslh | ||
|
|
||
| For Debian: | ||
|
|
@@ -79,13 +79,48 @@ client. | |
|
|
||
| ==== OpenVPN support ==== | ||
|
|
||
| OpenVPN clients reportedly take more than one second between | ||
| OpenVPN clients connecting to OpenVPN running with | ||
| -port-share reportedly take more than one second between | ||
| the time the TCP connexion is established and the time they | ||
| send the first data packet. This results in sslh with | ||
| default settings timing out and assuming an SSH connexion. | ||
| To support OpenVPN connexions reliably, it is necessary to | ||
| increase sslh's timeout to 5 seconds. | ||
|
|
||
| Instead of using OpenVPN's port sharing, it is more reliable | ||
| to use sslh's -o option to get sslh to do the port sharing. | ||
|
|
||
| ==== Using proxytunnel with sslh ==== | ||
|
|
||
| If you are connecting through a proxy that checks that the | ||
| outgoing connection really is SSL and rejects SSH, you can | ||
| encapsulate all your traffic in SSL using proxytunnel (this | ||
| should work with corkscrew as well). On the server side you | ||
| receive the traffic with stunnel to decapsulate SSL, then | ||
| pipe through sslh to switch HTTP on one side and SSL on the | ||
| other. | ||
|
|
||
| In that case, you end up with something like this: | ||
|
|
||
| ssh -> proxytunnel -e --------ssh/ssl------> stunnel ---ssh---> sslh --> sshd | ||
|
|
||
| navigateur --------http/ssl------> stunnel ---http---> sslh --> http:80 | ||
|
|
||
| Configuration goes like this: | ||
|
|
||
| On the server side, using stunnel3: | ||
| stunnel -f -p mycert.pem -d thelonious:443 -l /usr/local/sbin/sslh -- sslh -i -l localhost:80 -s localhost:22 | ||
|
|
||
| stunnel options: -f for foreground/debugging, -p specifies | ||
| the key + certificate, -d specifies which interface and port | ||
| we're listening to for incoming connexions, -l summons sslh | ||
| in inetd mode. | ||
|
|
||
| sslh options: -i for inetd mode, -l to forward SSL | ||
| connexions (in fact normal HTTP at that stage) to port 80, | ||
| and SSH connexions to port 22. This works because sslh | ||
| considers that anything that is not SSH is SSL. | ||
|
|
||
| ==== IP_TPROXY support ==== | ||
|
|
||
| There is a netfilter patch that adds an option to the Linux | ||
|
|
@@ -112,4 +147,12 @@ when/if the feature finds its way into the main kernel and | |
| it becomes usuable by non-root processes. | ||
|
|
||
|
|
||
| Comments? questions? [email protected] | ||
| ==== Comments? Questions? ==== | ||
|
|
||
| You can subscribe to the sslh mailing list here: | ||
| http://rutschle.net/cgi-bin/mailman/listinfo/sslh | ||
|
|
||
| This mailing list should be used for discussion, feature | ||
| requests, and will be the prefered channel for | ||
| announcements. | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
|
|
||
| sslh is available for Mac OS X via MacPorts. If you have | ||
| MacPorts installed on your system you can install sslh by | ||
| executing the following in the Terminal: | ||
|
|
||
| port install sslh | ||
|
|
||
| Also, the following is a helpful launchd configuration that | ||
| covers the most common use case of sslh. Save the following | ||
| into a text file, e.g. | ||
| /Library/LaunchDaemons/net.rutschle.sslh.plist, then load it | ||
| with launchctl or simply reboot. | ||
|
|
||
| ----BEGIN FILE---- | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" | ||
| "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | ||
| <plist version="1.0"> | ||
| <dict> | ||
| <key>Disabled</key> | ||
| <false/> | ||
| <key>KeepAlive</key> | ||
| <true/> | ||
| <key>Label</key> | ||
| <string>net.rutschle.sslh</string> | ||
| <key>ProgramArguments</key> | ||
| <array> | ||
| <string>/opt/local/sbin/sslh</string> | ||
| <string>-f</string> | ||
| <string>-v</string> | ||
| <string>-u</string> | ||
| <string>nobody</string> | ||
| <string>-p</string> | ||
| <string>0.0.0.0:443</string> | ||
| <string>-s</string> | ||
| <string>localhost:22</string> | ||
| <string>-l</string> | ||
| <string>localhost:443</string> | ||
| </array> | ||
| <key>QueueDirectories</key> | ||
| <array/> | ||
| <key>RunAtLoad</key> | ||
| <true/> | ||
| <key>StandardErrorPath</key> | ||
| <string>/Library/Logs/sslh.log</string> | ||
| <key>StandardOutPath</key> | ||
| <string>/Library/Logs/sslh.log</string> | ||
| <key>WatchPaths</key> | ||
| <array/> | ||
| </dict> | ||
| </plist> | ||
| ----END FILE---- | ||
|
|
||
|
|
Oops, something went wrong.