1

Is it possible to access third-party HTTPS pages over an SSH tunnel?


I have to access third-party websites with tight security rules from home-office.

Due to the security rules, only access from my work-PC will be allowed. I can access the work-PC by connecting to the work network through a VPN, and then can access everything via SSH. So I can access the third-party website through a remote wget (useless for a webapp), or by running a browser throw X-forwarding – with terrible performance, making it viable, but painful, for getting work done.

Since the configuration of the VPN cannot be changed due to limitations of the product in use, I have tried to tunnel the traffic to the third party website through the work PC using

ssh MyUserName@MyWorkPC.MyEmployer.com -L localhost:443:ThatCompany.com:443 -N
#                                      | ||        ||                     | | |
#                                      '.''----.---''--------.------------' '.'
#                      Port forwarding -'      |             |               |
#                                              |             |               |
#   Allow access to :443 only from localhost --'             |               |
#                                                            |               |
#   localhost:443 will access ThatCompany.com:443 -----------'               |
#                             through the work PC                Don't display shell
#                                                                of work PC

If I then try to access https://SubDomain.ThatCompany.com, I will get a 404 code and a page saying

You have reached the webserver of ThatComapany.
The URL you used is unknown to us, so we cannot allow you in.

Example: Trying to access Gmail through the tunnel.

The command would be

ssh MyUserName@MyWorkPC.MyEmployer.com -L localhost:443:google.com:443

If I then try to access https://mail.localhost I will get:

enter image description here

This demonstrates two issues:

  • The connection isn't considered secure, because the host name doesn't match the certificate.
  • The webserver will reject the connection; It probably suspects a man-in-the-middle attack.

Is there some way to configure the forwarding in such a manner, that the webserver won't know about it?

1
  • 1
    You have to use the correct host name when talking to web servers. Name-based virtual hosts is a thing. You could edit the hosts file to accomplish this.
    – Daniel B
    Mar 27 '20 at 15:11
2

You could try using a SOCKS proxy over SSH:

ssh MyUserName@MyWorkPC.MyEmployer.com -D 8080 -N

and then configure your web browser for a SOCKS proxy on 127.0.0.1:8080. You should then be able to access the site as normal in your browser.

More information on SOCKS proxies in this answer: https://superuser.com/a/1308648/1154554

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.