sslh(1p) [debian man page]

SSLH(1p)						User Contributed Perl Documentation						  SSLH(1p)

NAME

       sslh - Switch incoming connection between SSH and SSL/HTTPS servers

SYNOPSIS

       sslh [ -v ] [ -p [host:]port ] [ -t timeout ]
	    [ --ssh [host:]port ] [ --ssl [host:]port ]

DESCRIPTION

       sslh is a simple script that lets you switch an incoming connection on a single port between distinct SSH and SSL/HTTPS servers.

       sslh listens for connections on a port and is able to redirect them either to an HTTPS web server or a SSH server.

       This lets one setup both a HTTPS web server and a SSH server and access them through the same host+port.

OPTIONS

       The program follows the usual GNU command line syntax, with long options starting with two dashes.

       -p, --port [host:]port
	   The port the proxy will listen to.  If no port is given, 443 is used by default.  If no host is given, "localhost" is used by default.

       -s, --ssh [host:]port
	   The SSH server which the SSH connections must be forwarded to.  If omitted, the default is localhost:22.

       -l, --ssl, --https [host:]port
	   The HTTPS server which the HTTPS connections must be forwarded to.  If omitted, the default is localhost:443.

       -t, --timeout delay
	   Timeout in seconds before a silent incoming connection is considered as a SSH connection. The number can be fractional.

	   The default is 2seconds.

       -v, --verbose
	   Verbose output.  This option can be used several times for more verbose output.

EXAMPLE OF USE

       Is this tool actually useful? Yes.

       For example one can use it to access both a SSH server and a secure web server via a corporate proxy that only accepts to relay connections
       to port 443. Creating a tunnel that passes SSH connection through a CONNECT-enabled web proxy is easy with connect-tunnel (also included in
       the "Net::Proxy" distribution).

       The proxy will let both SSH and HTTPS connections out (since they all point to port 443), and the home server will connect those incoming
       connections to the appropriate server. This only requires to run the HTTPS server on a non standard port (not 443).

TECHNICAL NOTE

       How can this proxy find out what kind of protocol is using a TCP connection to port 443, without being connected (yet) to the server?  We
       actually rely on a slight difference between the SSL and SSH protocols (found thanks to ethereal):

       SSH Once the TCP connection is established, the server speaks first, presenting itself by saying something like:

	       SSH-2.0-OpenSSH_3.6.1p2 Debian 1:3.6.1p2-1

       SSL With SSL, it's always the client that speaks first.

       This means that sslh can be used with any pair of protocols/services that share this property (the client speaks first for one and the
       server speaks first for the other).

AUTHORS

       Original idea and C version
	   Frederic Ple "<sslh@wattoo.org>".

       Perl versions
	   Philippe 'BooK' Bruhat "<book@cpan.org>".

SCRIPT HISTORY

       Version 0.01 of the script was a quick hack designed in 2003 as a proof of concept.

       Version 0.02 (and higher) are based on "Net::Proxy", and included with the "Net::Proxy" distribution. Version 0.02 didn't work, though.

       Version 0.03 correctly initialised the "in" connector.

       Version 0.04 lets the proxy listen on any address (instead of "localhost", which is still the default). Thanks to Dieter Voegtli for
       spotting this.

SEE ALSO

       Net::Proxy, Net::Proxy::Connector::dual.

COPYRIGHT

       Copyright 2003-2006, Philippe Bruhat. All rights reserved.

LICENSE

       This module is free software; you can redistribute it or modify it under the same terms as Perl itself.

perl v5.10.1							    2009-10-18								  SSLH(1p)

SSLH(8) 																   SSLH(8)

NAME

	sslh - ssl/ssh multiplexer

SYNOPSIS

       sslh [-F config file] [ -t num ] [-p listening address [-p listening address ...] [--ssl target address for SSL] [--ssh target address for
       SSH] [--openvpn target address for OpenVPN] [--http target address for HTTP] [-u username] [-P pidfile] [-v] [-i] [-V] [-f] [-n]

DESCRIPTION

       sslh accepts connections in HTTP, HTTPS, SSH, OpenVPN, tinc, XMPP, or any other protocol that can be tested using a regular expression, on
       the same port. This makes it possible to connect to any of these servers on port 443 (e.g. from inside a corporate firewall, which almost
       never block port 443) while still serving HTTPS on that port.

       The idea is to have sslh listen to the external 443 port, accept the incoming connections, work out what type of connection it is, and then
       fordward to the appropriate server.

   Protocol detection
       The protocol detection is made based on the first bytes sent by the client: SSH connections start by identifying each other's versions
       using clear text "SSH-2.0" strings (or equivalent version strings). This is defined in RFC4253, 4.2. Meanwhile, OpenVPN clients start with
       0x00 0x0D 0x38, tinc clients start with "0 ", and XMPP client start with a packet containing "jabber".

       Additionally, two kind of SSH clients exist: the client waits for the server to send its version string ("Shy" client, which is the case of
       OpenSSH and Putty), or the client sends its version first ("Bold" client, which is the case of Bitvise Tunnelier and ConnectBot).

       If the client stays quiet after the timeout period, sslh will connect to the first protocol defined (in the configuration file, or on the
       command line), so SSH should be defined first in sslh configuration to accommodate for shy SSH clients.

   Libwrap support
       One drawback of sslh is that the ssh and httpd servers do not see the original IP address of the client anymore, as the connection is
       forwarded through sslh.	sslh provides enough logging to circumvent that problem.  However it is common to limit access to ssh using
       libwrap or tcpd. For this reason, sslh can be compiled to check SSH accesses against SSH access lists as defined in /etc/hosts.allow and
       /etc/hosts.deny.

   Configuration file
       A configuration file can be supplied to sslh. Command line arguments override file settings. sslh uses libconfig to parse the configuration
       file, so the general file format is indicated in <http://www.hyperrealm.com/libconfig/libconfig_manual.html>.  Please refer to the example
       configuration file provided with sslh for the specific format (Options have the same names as on the command line, except for the list of
       listen ports and the list of protocols).

       The configuration file makes it possible to specify protocols using regular expressions: a list of regular expressions is given as the
       probe parameter, and if the first packet received from the client matches any of these expressions, sslh connects to that protocol.

       Alternatively, the probe parameter can be set to "builtin", to use the compiled probes which are much faster than regular expressions.

OPTIONS

       -t num, --timeout num
	   Timeout before forwarding the connection to the first configured protocol (which should usually be SSH). Default is 2s.

       -p listening address, --listen listening address
	   Interface and port on which to listen, e.g. foobar:443, where foobar is the name of an interface (typically the IP address on which the
	   Internet connection ends up).

	   This can be specified several times to bind sslh to several addresses.

       --ssl target address
	   Interface and port on which to forward SSL connection, typically localhost:443.

	   Note that you can set sslh to listen on ext_ip:443 and httpd to listen on localhost:443: this allows clients inside your network to
	   just connect directly to httpd.

       --ssh target address
	   Interface and port on which to forward SSH connections, typically localhost:22.

       --openvpn target address
	   Interface and port on which to forward OpenVPN connections, typically localhost:1194.

       --xmpp target address
	   Interface and port on which to forward XMPP connections, typically localhost:5222.

       --tinc target address
	   Interface and port on which to forward tinc connections, typically localhost:655.

	   This is experimental. If you use this feature, please report the results (even if it works!)

       -v, --verbose
	   Increase verboseness.

       -n, --numeric
	   Do not attempt to resolve hostnames: logs will contain IP addresses. This is mostly useful if the system's DNS is slow and running the
	   sslh-select variant, as DNS requests will hang all connections.

       -V  Prints sslh version.

       -u username, --user username
	   Requires to run under the specified username.

       -P pidfile, --pidfile pidfile
	   Specifies a file in which to write the PID of the main server.

       -i, --inetd
	   Runs as an inetd server. Options -P (PID file), -p (listen address), -u (user) are ignored.

       -f, --foreground
	   Runs in foreground. The server will not fork and will remain connected to the terminal. Messages normally sent to syslog will also be
	   sent to stderr.

       --background
	   Runs in background. This overrides foreground if set in the configuration file (or on the command line, but there is no point setting
	   both on the command line unless you have a personality disorder).

FILES

       /etc/init.d/sslh
	   Start-up script. The standard actions start, stop and restart are supported.

       /etc/default/sslh
	   Server configuration. These are environment variables loaded by the start-up script and passed to sslh as command-line arguments. Refer
	   to the OPTIONS section for a detailed explanation of the variables used by sslh.

SEE ALSO

       Last version available from <http://www.rutschle.net/tech/sslh>, and can be tracked from <http://freecode.com/projects/sslh>.

AUTHOR

       Written by Yves Rutschle

v1.13b								    2012-08-26								   SSLH(8)