I'm inside a strict corporate environment. https traffic goes out via an internal proxy (for this example it's that's smart enough to block ssh'ing directly to ssh.glakspod.org:443.

I can get out via proxytunnel. I set up an apache2 VirtualHost at ssh.glakspod.org:443 thus:

ServerAdmin ssh@orly.glakspod.org ServerName ssh.glakspod.org

    <!-- Proxy Section -->
    <!-- Used in conjunction with ProxyTunnel -->
    <!-- proxytunnel -q -p -r ssh.glakspod.org:443 -d %host:%port -->
    ProxyRequests on
    ProxyVia on
    AllowCONNECT 22
    <Proxy *>
            Order deny,allow
            Deny from all
            Allow from 74.101

So far so good: I hit the Apache proxy with a CONNECT and then PuTTY and my ssh server shake hands and I'm off to the races.

There are, however, two problems with this setup:

  1. The internal proxy server can sniff my CONNECT request and also see that an SSH handshake is taking place. I want the entire connection between my desktop and ssh.glakspod.org:443 to look like HTTPS traffic no matter how closely the internal proxy inspects it.

  2. I can't get the VirtualHost to be a regular https site while proxying. I'd like the proxy to coexist with something like this: SSLEngine on SSLProxyEngine on SSLCertificateFile /path/to/ca/samapache.crt SSLCertificateKeyFile /path/to/ca/samapache.key SSLCACertificateFile /path/to/ca/ca.crt

    DocumentRoot /mnt/wallabee/www/html
    <Directory /mnt/wallabee/www/html/>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride None
            Order allow,deny
            allow from all
    <!-- Need a valid client cert to get into the sanctum -->
    <Directory /mnt/wallabee/www/html/sanctum>
            SSLVerifyClient require
            SSLOptions +FakeBasicAuth +ExportCertData
            SSLVerifyDepth 1

So my question is: How to I enable SSL support on the ssh.glakspod.org:443 VirtualHost that will work with ProxyTunnel?

I've tried various combinations of proxytunnel's -e, -E, and -X flags without any luck.

The only lead I've found is Apache Bug No. 29744, but I haven't been able to find a patch that will install cleanly on Ubuntu Jaunty's Apache version 2.2.11-2ubuntu2.6.

Thanks in advance.


I pieced together the answer from the proxytunnel-users mailing list.

First, looking at the Apache bugreport number 29744, the attachment containing the patch for my version of Apache, 2.2.11-2ubuntu2.6, was hidden because it was considered obsolete. Clicking on the "Show Obsolete" link in the lower-right corner of the attachments box revealed the patch.

So I did an apt-get source apache2 on my jaunty box, patched the source, did a debuild . . . ate some cereal . . . and then did a dpkg -i *.deb on everything I built.

Now those two separate Apache snippets above live together in harmony.

The last piece of the puzzle is how to call proxytunnel. Here's what worked:

proxytunnel -q -X -p -r ssh.glakspod.org:443 -d %host:%port ServerAliveInterval 30

Hope this helps someone else down the line!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.