2

I got an ubuntu server box jailed behind a VPN. The gateway somehow patches the certificates, so all my https connections show up "failed"

$ curl https://www.google.com
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: http://curl.haxx.se/docs/sslcerts.html

My ca-certificates are updated. That is not the problem.

I need to set up a temporary proxy that can handle https to update the box.

I tried doing an ssh -D 8080 user@my_home_pc to tunnel out. Netstat reports port open:

$ netstat -ntl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:995             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:110             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:143             0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN <---
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN

APT uses https_proxy environment variable. Sudo's -E option preserves env variables.

$ https_proxy=https://localhost:8080 sudo -E apt-get update
Ign https://get.docker.com docker InRelease
Ign https://get.docker.com docker Release.gpg
Ign https://get.docker.com docker Release
Ign https://get.docker.com docker/main i386 Packages/DiffIndex
Ign https://get.docker.com docker/main Translation-en
Err https://get.docker.com docker/main i386 Packages  <----
  Proxy CONNECT aborted                               <----

What would you do to set up a proxy tunneled by ssh? Consider that I can ONLY reach the outside by ssh (besides the unusefull gateway). THX.

Edit: AllowTcpForwarding is set to yes on my homepc

# /etc/ssh/sshd_config
AllowTcpForwarding yes
Improve this question

1 Answer 1

Reset to default
1

THIS ANSWER IS NOT CONSIDERED TO BE AN ANSWER, BUT A WORKAROUND.

Not final, but a workaround.

In this case, the unreachable site is https://get.docker.com

Approach:

  1. Fake the IP of get.docker.com
  2. SSH tunnel out and link a port to get.docker.com from the outside.

Procedure:

  1. Add get.docker.com to /etc/hosts

    cat "127.0.0.1  get.docker.com" >> /etc/hosts

  2. SSH out to uncaged box and forward. It has to be done with sudo as we'll be forwarding a port below 1024.

    sudo ssh -L 443:get.docker.com:443 user@myhomepc

  3. On another terminal, install everything as usual.

Oh, and remember to erase the added line on /etc/hosts when you're done.

Improve this answer
4
  • to elaborate on your solution, but then to ask you a question, so apt-get tries to connect to get.docker.com:443 ends up connecting to 127.0.0.1:443 then to the uncaged machine, which connects properly to get.docker.com:443 so ssh becomes rather like a transparent proxy in its tcp remapping.. interesting. But what if he has different sites apt-get wants to access? is there an SSH -D form that'd sort that, or some workaround?
    – barlop
    Jan 22, 2015 at 21:11
  • @barlop: Nope... SSH -D alone, kind of behaves as a socks connection, and as shown in the question, it just aborts. I guess because https (ssl) enforces a no man-in-the-middle connection, but... well that raises another question. How does an https proxy work. Well, this might create an expanding bubble of questions.
    – Carlos Troncoso
    Jan 23, 2015 at 6:18
  • I am aware of what SSH -D does. The problem with your workaround is it only works for one site or n tunnels work for n sites but he has to know what sites or he has to make many tunnels and there may be I don't know, 20 sites. So is there any solution you can think of, let's say without SSH -D, that works for whatever site. (besides an unwritten program to see what host apt-get wants to or would want to resolve, and create all the tunnels and 127.0.0.1 entries for them)
    – barlop
    Jan 23, 2015 at 17:28
  • The problem he has with ssh -D is it is local.. and his problem is local. I don't understand the other problem with it about MITM? I think maybe an http/https proxy would work.. but there's no -R with -D. So maybe if he does SSH -D on the remote computer, then on the local computer, does SSH -L forwarding to that. Then (no hosts file) he needs to get apt-get to use that local ip:port which will forward to the proxy.
    – barlop
    Jan 23, 2015 at 17:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .