SSH & SOCKS inside an HTTPS encrypted tunnel using a Windows Apache Server or what?

Question

I have spent hours reviewing Super/Stack and other sites and I haven't found the answer yet. So, I am going to give it a shot to ask here again. I would point out some partial answers I found in links but they are so convoluted or half answered I think it may make things worse for anyone that reads this.

So far, I have been able to set up an Apache server running on my local PC with a self signed cert. I have my router port forwarding 443 to this server. I also have OpenSSH running on port 22 on my local PC. My goal is:

1. I want to be able to connect from Putty/WinSCP to my PC on port 22, tunneled through the 443 SSL connection, and to browse via SOCKS as if I am on said PC.

2. I could try Stunnel, SSHL, HTTPProxy, Httptunnel, Corkscrew client side or whatever someone can clearly explain how to do (or link to a guide) but it must run on Windows.

3. My preference would be to set up the Apache server (mod_proxy / proxy pass?) to (on its own?) forward the incoming 443 to port 22 for OpenSSH to pick up the connection and SOCKS for browsing.

   NOTE: Here is a description of the flow. I can not use a VPN (already on one) and I can't use 443 on SSH because the layer 7 FW sees the SSH protocol and blocks it. Client PC is already on VPN, so no VPN can be used.

Win PcA > Win ServerB running something (Apache/Nginx?) {SSL}

Then while HTTPS is active and encrypted send:

Win PcA > Win ServerB running OpenSSH {SSH} via WinSCP or Putty for SFTP

&

Win PcA > Win ServerB running OpenSSH {SSH} via Putty for SOCKS via Browser

This is for knowledge purposes mostly, but I realize it's for FW punching as well. Since they are all my computers I can install software on the client side if need be, but the best thing would be to have no software except Putty/WinSCP & a browser I can change the proxy port on client side. This way if I ever have to run this from a PC that I do not own, I can most likely get away with putty/WinSCP without raising flags or needing admin rights.

I have heard about Squid and Ngnix for server side as Proxy servers, but currently I have Apache 2.4 running. I could change it I guess. Basically I want to create sort of a Inet browsing (via SOCKS proxy) and file transfer endpoint (via 22 fully hidden in SSL) which I could reach from anywhere, which would not be blocked as long as the network I am on permits SSL connections.

The guides out there to set up Apache and a self signed cert got me this far...now I am stuck with too many options. Thanks for reading.

Edit: There are questions like this out there with no answers, and with confusing answers. But nothing complete to me. Also, I am not sure my question is formatted correctly. New around here.

Answer 1

SSH is already using SSL to encrypt the traffic. In order to use the (often) allowed HTTPS port tcp/443 to connect to your home SSH server, you would only need to configure both your SSH client and SSH server to use port tcp/443. WinSCP as a client allows this. Depending on the software used for the SSH server this should be possible as well, as well as installing your own SSL certificate.

You would not need to have Apache installed for this. In fact, as Apache would terminate the SSL connection, encrpyted traffic from there to a local SSH server would not be possible (but e.g. unencrypted telnet).

If you need to evade application recognition one could think of creating an SSL VPN tunnel over which you would start an SSH tunnel...part of which you mention with Apache + OpenSSH. You'd need an additional software for the SSL VPN server, like (?) OpenVPN which will not be a part of Apache at all.

Answer 2

I don't know much about VMs, so assuming that you can deal with VM issuses. This guide should help.

You will set up a stunnel4 server like in the guide(change connect to 127.0.0.1:22 and accept to 443), then make ssh server like normal.

After go on to the client pc download and the Stunnel Client, right click on the tray icon and go to Edit Configuration copy this(change the ip):

[ssh]
client = yes
accept = 127.0.0.1:22
connect = [ip address of the server]:443

Now go back to the menu and click Reload Configuration. And you're done; you should just connect to ssh but using 127.0.0.1:22.