Sometimes in bigger Companies there are Security policies that do not permit outgoing SSH & HTTP/S Traffic. There is often used a Proxy like Squid to surfing the Web via HTTP/S. But no capability to use SSH.
I found a great Solution to bypass this by using a Tool named “corkscrew”. With corkscrew you can tunnel SSH traffic over an HTTPS Proxy. You can get it from there.
Its a little bit work to compile it but it is worth for sure.
After the building of your Binary you can place it in /usr/local/bin/
As next you need to add or create some Config information into $HOME/.ssh/config
Host *
ProxyCommand /usr/local/bin/corkscrew http-proxy.example.com 8080 %h %p
If you only have a few Hosts Outside you can replace * with your Connections.
Also replace “http-proxy.example.com 8080” with your Proxy Data.
In my experience often the Firewall restrictions for the Proxy only allow Port 80 & 443. So, your SSH Counterpart has to listen on that Port to establish a Connection, too.
If you have a Mac OS X Machine on the Web as Counterpart you have to told sshd to listen on Port 443. If you do this, there is no Chance to use the same Computer as a Webserver that provide HTTPS Services!
The following worked for me under Snow Leopard and should work with Leopard as well.
First Add to /etc/services these 2 Lines:
ssh443 443/udp # SSH 443
ssh443 443/tcp # SSH 443
As next Copy the ssh.plist that Control sshd.
cp /System/Library/LaunchDaemons/ssh.plist /Library/LaunchDaemons/ssh443.plist
Edit /Library/LaunchDaemons/ssh443.plist like this:
<?xml version=”1.0″ encoding=”UTF-8″?>
<!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd”>
<plist version=”1.0″>
<dict>
<key>Label</key>
<string>com.openssh443.sshd</string>
<key>Program</key>
<string>/usr/libexec/sshd-keygen-wrapper</string>
<key>ProgramArguments</key>
<array>
<string>/usr/sbin/sshd</string>
<string>-i</string>
</array>
<key>SHAuthorizationRight</key>
<string>system.preferences</string>
<key>Sockets</key>
<dict>
<key>Listeners</key>
<dict>
<key>Bonjour</key>
<array>
<string>ssh</string>
<string>sftp-ssh</string>
</array>
<key>SockServiceName</key>
<string>ssh443</string>
</dict>
</dict>
<key>StandardErrorPath</key>
<string>/dev/null</string>
<key>inetdCompatibility</key>
<dict>
<key>Wait</key>
<false/>
</dict>
</dict>
</plist>
You have to Change “Label” & “SocketServiceName” Information.
That’s all, now you can load the plist File with:
launchctl load -w /Library/LaunchDaemons/ssh443.plist
To deactivate you only need to unload the Property List.
launchctl unload -w /Library/LaunchDaemons/ssh443.plist
This Config doesn’t influence the Apple SSH Config at
/System/Library/LaunchDaemons/ssh.plist
and runs independently!
Now you should be able to connect your internal Machine with your external Machine by following Command:
ssh -p 443 user@myexternalmachine.com
