Why isn't openssl s_client passing my private key to proxytunnel?

Question

I currently have HAProxy set up on my home PC and I am attempting to access it through a HTTP proxy. Currently I am accessing the SSH logon prompt like so:

openssl s_client->proxytunnel->HTTP(S) proxy->remote HAProxy->SSH server

I am getting to the point where I receive the SSH-2.0-OpenSSH prompt but for some reason it just hangs at the prompt and doesn’t pass through the private key.

Here’s the commands I am executing on the client side & how I set up proxy tunnel to use the organization's proxy:

proxytunnel -p httpproxy.organization.com:8080 -d ssh.homeserver.com:443 -a 7000

Next I am running openssl like so:

openssl s_client -connect localhost:7000 -quiet -key /home/user/.ssh/id_rsa

But for some reason the certificate does not appear to get passed through. I am most likely missing a step so any suggestions would be greatly appreciated!

Answer 1

You are confusing the clients of two completely different protocols.

The openssl s_client tool is purely a TLS (SSL) client; it is capable of peeling away the TLS layer that HAproxy or stunnel might add. Once that's done, however, it merely transfers arbitrary data from one end to another. The prompt you're seeing is the initial SSH handshake, and the server expects you to reply to it; therefore, you still need to run a program like ssh that would talk the SSH protocol on top of the TLS tunnel.

Usually ssh connects to the server over TCP directly, but you can use the ProxyCommand option tell it to go through another program:

ssh -o ProxyCommand="openssl s_client -connect localhost:7000 -quiet" dummyname

---

If you have a SSH keypair, you'll need to specify it as an option to ssh as well:

ssh -i ~/.ssh/id_workplace -o ProxyCommand.....

(Don't need this for ~/.ssh/id_rsa though – it is used by default.)

---

The s_client options -cert and -key are of course for authenticating to the TLS server. However, they need a full X.509 certificate as "-cert"; just the public key isn't enough, as it would be for SSH.