Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm behind a corporate network with an HTTP proxy. I also have an SSH server to reach on port 22. I don't have any kind of control over that server: I'm not root and even if I were I'm not allowed to install software or change configuration. The server listens on port 22, must be reached there and this cannot be changed ever.

If I configure XShell (but the same should apply to any other client) to use the corporate proxy I can't connect. Wiresharking it shows that CONNECT method gets refused by proxy because "that's not an SSL standard port".

I believe that the proxy blocks traffic to ports other than 80 and 443. Without doing deep packet inspection or other esotheric tricks.

I have been linked an article about configuring HTTP proxy for SSH "when the proxy filters SSH protocol" but the problem is that it works for Linux and I have another problem with it (it doesn't detect network card, already asked here...).

The question is: how to bypass the proxy without installing software or changing configuration on the target machine?

I would also like to understand

  1. Since the proxy blocks port 22 instead of SSH protocol by deep packet inspection, does the linked guide work when the server listens on port 22 and cannot be changed any way ever?
  2. Is there a way to make it work on Windows?
share|improve this question

1 Answer 1

up vote 2 down vote accepted

For any corporate proxying issue I suggest proxytunnel (over corkscrew) because it makes the traffic completely indistinguishable from real HTTPS traffic, even if full packet-sniffing were to be used.

This solution requires a https server under your control (possibly on the same machine your ssh server is running) which the corporate proxy talks to.

The answer to your first question is: proxytunnel will work around your corporate proxy blocking except in the unlikely case they generally block your https server. Further docs are found here and here

I use it with great success on an linux machine. There appear to be docs and binaries for windows around (2nd question):

http://proxytunnel.sourceforge.net/download.php

http://egret.psychol.cam.ac.uk/techniques/firewall.html

If you are lucky in your situation a simpler solution could also do the job. Together with corkscrew just setup an intermediate ssh server somewhere which forwards a port with blessing of your corporate proxy to port 22 of your target ssh server.

share|improve this answer
    
Sorry. I said that the proxy blocks port 22 on the CONNECT invocation, it doesn't give the client the time to initiate SSH handshake. So no DPI, just port filtering and absolutely no way to change the machine's listening port –  djechelon Jan 17 '13 at 8:35
    
Question needs clarification. I can't install software on the target machine. I'm not root there –  djechelon Jan 17 '13 at 8:41
    
OK +1 because if I find another server where I can install software I can use it as HTTPS->SSH proxy to the target server. I might accept the answer, many thanks :) –  djechelon Jan 17 '13 at 8:47
    
The second link is particularly well made and detailed. I'm eager to test it! –  user39559 Jun 28 '13 at 13:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.