Yves Rutschle

This is interesting but incomplete. It may not survive to deep packet inspection or rate limiting. Even worse - your only S3 machine could get blacklisted, and I don't see why operators wouldn't share blacklist the way it's done to fight spam.

So my suggestion is to have multiple alternatives instead, as in lines of defense.

First, a simple SSH server also running a socks and a http proxy is useful. Easy to reach and configure - some browser work better with http proxy (or was it sock? Opera only supports one but I can't remember which at the moment)

In the second line, you want to run the SSH server on a nonstandard port as the author does. I suggest multiplexing the port : simply run SSLH on both port 80 and 443, with the patch published on http://rutschle.net/pipermail/sslh/2012-April/000202.html

But that will not look like a standard SSL connection. Even worse, if you use your own certificate - operators could deny all self-signed certificates.

So get stunnel running on port 443 with a "usual" certificate instead, and pass the traffic on port 80 where you'll be happy to have SSLH or whatever you prefer - like Openvpn which can do port sharing or which can be put "behind" stunnel and sslh, so that you will use a standard 443 port, and do a genuine SSL connection on that port. Much better. Have some fun with burst.net - they offer you 2 IP for like $7/month : you can do some routing and give the 2nd IP address to your laptop on the other end of the tunnel. Now that is…

> apt-cache search ssh http
[...]
sslh - ssl/ssh multiplexer
http://www.rutschle.net/tech/sslh.shtml

I mean, it's cool that you got the exercise of implementing this in Go and all, but I don't see what's new and interesting about it.

(and another implementation in Perl almost 4 years ago: https://news.ycombinator.com/item?id=2395787)

Edit: oh whoops, didn't get to OP's "Why not sslh" section :\ "The result is useful in its own right through use of Go's interfaces for protocol matching (making adding new protocols trivial), and lightweight goroutines (instead of forking, which is more CPU intensive under load)."

Well alright, the first point I'll concede, though I'm wary of the "reinvented wheel" scent, the second point I'm even more uncomfortable with as I think it makes wild assumptions of the kind of environment this tool could be useful in.

If they're proxying HTTP traffic usually they'll block SSH and other protocols. To work around this use an HTTPS/SSH multiplexer[1][2][3] or a simple reverse proxy to accept HTTP[S] connections and connect them to an SSH server on the backend. For the ssh client use a ProxyCommand tunneling app[4][5][6] to turn an HTTP[S] proxy request into a two-way socket, and you have an SSH connection over HTTP proxies.

[1] http://www.rutschle.net/tech/sslh.shtml
[2] http://www.pond-weed.com/multiplex/
[3] https://github.com/stealth/sshttp
[4] http://zwitterion.org/software/ssh-https-tunnel/ssh-https-tunnel
[5] http://proxytunnel.sourceforge.net/
[6] http://www.agroman.net/corkscrew/

sslh [1] (which is packaged and included in may linux and BSD distributions) has grown to support HTTP, SSL, SSH, OpenVPN, tinc, XMPP from the same port. It claims it can be extended to filter anything that can match with a regex.

What I find lacking lately is I've mostly wanted to extend the forwarding/routing of ssh connections based on username (or better by identity) to different VMs or hosts, but I have no idea how to achieve that at the moment (without creating dummy users on the sshd server).

[1] http://www.rutschle.net/tech/sslh.shtml

Github: https://github.com/yrutschle/sslh

No love for sslh?

“ Probes for HTTP, TLS/SSL (including SNI and ALPN), SSH, OpenVPN, tinc, XMPP, SOCKS5, are implemented, and any other protocol that can be tested using a regular expression, can be recognised. A typical use case is to allow serving several services on port 443 (e.g. to connect to SSH from inside a corporate firewall, which almost never block port 443) while still serving HTTPS on that port.”

https://www.rutschle.net/tech/sslh/README.html

> if the server is also hosting some https website, then put it on an alternate ipv6 address (they are free if not cheap) and ssh into that.

There's also sslh, which can multiplex the same port by detecting whether the incoming connection is TLS or SSH, and forwarding appropriately. It's pretty cool: https://www.rutschle.net/tech/sslh/README.html

That said, I think this service is for people who need to use computers without ssh clients installed locally.