|
|
Corkscrew (Program)Corkscrew enables you to run SSH connections over most HTTPS proxy servers. Due to SSH features such as port forwarding, this can allow many types of services to be run safely over the SSH via HTTPS connections. Home page: http://www.agroman.net/corkscrew/ Supported proxy servers: One problem with this approach is that proxy servers generally have an idle timeout setup for HTTP/HTTPS connections. Values of 10 minutes or so can possibly be tolerated, but some have this value very low (say 30 seconds). This of course causes your SSH sessions to die after the set timeout if they are left idle. One way to work around this is to modify the TCP/IP stack keepalive values on the client machine and the machine running the ssh server. Most default keepalives do not kick in until a large amount of time has gone by, however, so this approach would mean modifying the keepalive values on all (outside) machines you want to connect to. Not terribly great. A good workaround for this problem is to install the heartbeat patch for OpenSSH. - http://www.sc.isc.tohoku.ac.jp/~hgot/sources/openssh-watchdog.html
You can apply this patch on the client machine (the one behind the restrictive firewall/proxy) and then setup a heartbeat for every 15 seconds or so, and your connections will not die due to idle timeout. This approach has worked consistently well. Practical use One very handy use of this, is to setup squid on a remote machine (outside restrictive firewall), and port forward from your client machine, across said firewall, to the box with squid. Then, you can set your local browser to use the local port as its proxy server, and you can have all of your web traffic be unreadable to the firewall. Assume that squid is configured on remotehost to listen on 127.0.0.1:8080. To start ssh port forward: ssh -L 8080:127.0.0.1:8080 remotehost.com Then, just have your browser use 127.0.0.1:8080 as its proxy server, and you are set. Refer to the squid page for information on anonymizing you can have squid automatically do for your HTTP traffic. Credit The article contains material from InfoAnarchy
|
 |