Skip to content
No description, website, or topics provided.
Branch: master
Clone or download
Latest commit d1350a2 Jun 1, 2017
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
huproxyclient Add license stuff May 19, 2017
lib Add license stuff May 19, 2017
.gitignore
CONTRIBUTING.md Rename CONTRIBUTING.MD to CONTRIBUTING.md Jun 1, 2017
LICENSE Add license stuff May 19, 2017
README.md
huproxy.go Add license stuff May 19, 2017

README.md

HUProxy

Copyright 2017 Google Inc.

This is not a Google product.

HTTP(S)-Upgrade Proxy — Tunnel anything (but primarily SSH) over HTTP websockets.

Why

The reason for not simply using a SOCKS proxy or similar is that they tend to take up an entire port, while huproxy only takes up a single URL subdirectory.

There's also SSL/SSH multiplexers but they:

  1. Take over the port and front both the web server and SSH, instead of letting the web server be the primary owner of port 443.
  2. For SSH don't look like SSL for packet inspectors, because they're not.
  3. Hide the original client address from the web server (without some interesting iptables magic).
  4. Only allow connecting to the server itself, not treat it as a proxy jumpgate.

Setup

nginx

Create user

sudo htpasswd -c /etc/nginx/users.proxy thomas

Add config to nginx

map $http_upgrade $connection_upgrade {
    default upgrade;
         '' close;
}
location /proxy {
    auth_basic "Proxy";
    auth_basic_user_file /etc/nginx/users.proxy;
    proxy_pass http://127.0.0.1:8086;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    # proxy_set_header Connection "upgrade";
    proxy_set_header Connection $connection_upgrade;
}

Start proxy:

./huproxy

Running

These commands assume that HTTPS is used. If not, then change "wss://" to "ws://".

echo thomas:secretpassword > ~/.huproxy.pw
chmod 600 ~/.huproxy.pw
cat >> ~/.ssh/config << EOF
Host shell.example.com
    ProxyCommand /path/to/huproxyclient -auth=@$HOME/.huproxy.pw wss://proxy.example.com/proxy/%h/%p
EOF

ssh shell.example.com

Or manually with these commands:

ssh -o 'ProxyCommand=./huproxyclient -auth=thomas:secretpassword wss://proxy.example.com/proxy/%h/%p' shell.example.com
ssh -o 'ProxyCommand=./huproxyclient -auth=@<(echo thomas:secretpassword) wss://proxy.example.com/proxy/%h/%p' shell.example.com
ssh -o 'ProxyCommand=./huproxyclient -auth=@$HOME/.huproxy.pw wss://proxy.example.com/proxy/%h/%p' shell.example.com
You can’t perform that action at this time.