Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can I reroute the https traffic (of an svn repository) via ssh-tunnel.

The problem is that the the services that use https don't work if I just create one tunnel for listening with e.g.:

ssh -L 12345:server.com:443 localhost

Do I have to do something else? The aim is to tunnel https://PROJECT.googlecode.com/svn/ where PROJECT is the project name.

share|improve this question

HTTPS connection can be redirected via SSH port forwarding - however the SSL/TLS certificate validation will fail in such cases as the host name does not match:

You are connecting to https://localhost:12345 but the server certificate contains the name server.com.

Instead of directly forwarding the HTTPS connection I would run an HTTP(s)/SOCKS proxy on the remote computer you are opening the SSH connection to. Then set-up the program you want to tunnel to use this proxy through port forwarding. This would be a clean solution.

Update: It seems like SVN can use HTTP proxies but not SOCKS proxies. If want to do so you need an additional "socksifier" on your local system. See Serverfault.com: How can I set proxy for subversion with ssh tunnel?

share|improve this answer
    
Can I actually use this kind of approach: dltj.org/article/ssh-as-socks-proxy? So in the googlecode case, I would have a local-computer -> socks-computer -> googlecode. And this "ssh -D" would be run on local computer: ssh -D 12345 [username]@[socks-computer]. Now I have to tell svn to use proxy at local-computer:12345. Do I need something else? – Juha Oct 19 '11 at 11:26
    
Cool, I did not know that OpenSSH already includes a SOCKS proxy. See also my updated answer. – Robert Oct 19 '11 at 11:38
    
You can get around the HTTPS certificate issue by adding the remote host to your local hosts file with ip address 127.0.0.1. Then you can actually use remotehost:12345 address but the traffic will still be directed to SSH tunnel. – Juha Palomäki Aug 14 '13 at 11:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .