SSLH
SSLH – Share A Same Port For HTTPS And SSH
Some Internet service providers and corporate companies might have blocked most of the ports, and allowed only a few specific ports such as port 80 and 443 to tighten their security. In such cases, we have no choice, but use a same port for multiple programs, say the HTTPS Port 443, which is rarely blocked. Here is where SSLH, a SSL/SSH multiplexer, comes in help. It will listen for incoming connections on a port 443. To put this more simply, SSLH allows us to run several programs/services on port 443 on a Linux system. So, you can use both SSL and SSH using a same port at the same time. If you ever been in a situation where most ports are blocked by the firewalls, you can use SSLH to access your remote server. This brief tutorial describes how to share a same port for https, ssh using SSLH in Unix-like operating systems.
SSLH – Share A Same Port For HTTPS, SSH, And OpenVPN
Install SSLH
SSLH is packaged for most Linux distributions, so you can install it using the default package managers.
On Debian, Ubuntu, and derivatives, run:
While installing SSLH, you will prompted whether you want to run sslh as a service from inetd, or as a standalone server. Each choice has its own benefits. With only a few connection per day, it is probably better to run sslh from inetd in order to save resources. On the other hand, with many connections, sslh should run as a standalone server to avoid spawning a new process for each incoming connection.
Install sslh
On Arch Linux and derivatives like Antergos, Manjaro Linux, install it using Pacman as shown below.
On RHEL, CentOS, you need to add EPEL repository and then install SSLH as shown below.
On Fedora:
If it is not available on default repositories, you can manually compile and install SSLH as described here.
Configure Apache or Nginx webservers
As you already know, Apache and Nginx webservers will listen on all network interfaces (i.e 0.0.0.0:443) by default. We need to change this setting to tell the webserver to listen on the localhost interface only (i.e 127.0.0.1:443 or localhost:443).
To do so, edit the webserver (nginx or apache) configuration file and find the following line:
And, change it to:
If you’re using Virutalhosts in Apache, make sure you have changed that it too.
Save and close the config files. Do not restart the services. We haven’t finished yet.
Configure SSLH
Once you have made the webservers to listen on local interface only, edit SSLH config file:
Find the following line:
And, change it to:
Then, scroll a little bit down and modify the following line to allow SSLH to listen on port 443 on all available interfaces (Eg. 0.0.0.0:443).
Where,
- –user sslh : Requires to run under this specified username.
- –listen 0.0.0.0:443 : SSLH is listening on port 443 on all available interfaces.
- –sshs 127.0.0.1:22 : Route SSH traffic to port 22 on the localhost.
- –ssl 127.0.0.1:443 : Route HTTPS/SSL traffic to port 443 on the localhost.
Save and close the file.
Finally, enable and start sslh service to update the changes.
Testing
Check if the SSLH daemon is listening to 443.
Now, you can access your remote server via SSH using port 443:
Sample output:
Access remote systems via SSH using port 443
See? I can now be able to access the remote server via SSH even if the default SSH port 22 is blocked. As you see in the above example, I have used the https port 443 for SSH connection. Also, we can use the same port 443 for openVPN connections too.
Suggested read:
- How To SSH Into A Particular Directory On Linux
- How To Create SSH Alias In Linux
- How To Configure SSH Key-based Authentication In Linux
- How To Stop SSH Session From Disconnecting In Linux
- Allow Or Deny SSH Access To A Particular User Or Group In Linux
- 4 Ways To Keep A Command Running After You Log Out Of The SSH Session
- ScanSSH – Fast SSH Server And Open Proxy Scanner
I tested SSLH on my Ubuntu 18.04 LTS server and it worked just fine as described above. I tested SSLH in a protected local area network, so I am not aware of the security issues. If you’re using it in production, let us know the advantages and disadvantages of using SSLH in the comment section below.
For more details, check the official GitHub page given below.
Resource:
No comments