sslh - Revision history

Vincent: Fix stop command

2020-09-05T08:50:33Z

Fix stop command

← Older revision		Revision as of 08:50, 5 September 2020
Line 89:		Line 89:
	# Table 0x4155 to route all packets back to loopback interface		# Table 0x4155 to route all packets back to loopback interface
	ExecStartPre=/sbin/ip route add local 0.0.0.0/0 dev lo table 0x4155		ExecStartPre=/sbin/ip route add local 0.0.0.0/0 dev lo table 0x4155
	ExecStopPost=/sbin/ip route del table 0x4155		ExecStopPost=/sbin/ip route del local 0.0.0.0/0 dev lo table 0x4155
	</syntaxhighlight>If using the <code>Capabilities=</code> rule for systemd 228-, you need to give the binary some capabilities as well<syntaxhighlight lang="console">		</syntaxhighlight>If using the <code>Capabilities=</code> rule for systemd 228-, you need to give the binary some capabilities as well<syntaxhighlight lang="console">
	$ sudo setcap cap_net_bind_service,cap_net_admin+ei /usr/sbin/sslh-select		$ sudo setcap cap_net_bind_service,cap_net_admin+ei /usr/sbin/sslh-select

Vincent: /* sslh */ default config for systemd >= 229

2020-09-04T09:59:42Z

sslh: default config for systemd >= 229

← Older revision		Revision as of 09:59, 4 September 2020
Line 69:		Line 69:
	User=sslh		User=sslh
	# Systemd 229		# Systemd 229
	#AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN		AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
	# Systemd 228 and bellow		# Systemd 228 and bellow
	SecureBits=keep-caps		#SecureBits=keep-caps
	Capabilities=cap_net_bind_service,cap_net_admin+pie		#Capabilities=cap_net_bind_service,cap_net_admin+pie

	# Limit access		# Limit access

Vincent: Make alex happy

2017-02-17T12:33:01Z

Make alex happy

← Older revision		Revision as of 12:33, 17 February 2017
Line 4:		Line 4:
	This guide will show how to install sslh in transparent mode with [[nftables]]. It will also use the lighter <code>sslh-select</code> instead of the simpler <code>sslh-fork</code>. For other modes of operation, refer to [https://github.com/yrutschle/sslh the documentation].		This guide will show how to install sslh in transparent mode with [[nftables]]. It will also use the lighter <code>sslh-select</code> instead of the simpler <code>sslh-fork</code>. For other modes of operation, refer to [https://github.com/yrutschle/sslh the documentation].

	{{Warning}}Using SSH can be a violation of your corporate internet use policy. Please act responsibly. In particular, '''never ever create a reverse tunnel''' from your company network. Also this tool is not disguising ~~SHH~~ traffic as web but simply changing the port and can be easily detected by your network administrator.		{{Warning\|msg=}}Using SSH can be a violation of your corporate internet use policy. Please act responsibly. In particular, '''never ever create a reverse tunnel''' from your company network. Also this tool is not disguising SSH traffic as web but simply changing the port and can be easily detected by your network administrator.

	== Prerequisite ==		== Prerequisite ==

Vincent: sudo

2017-02-15T06:54:28Z

sudo

← Older revision		Revision as of 06:54, 15 February 2017
Line 14:		Line 14:
	== Install ==		== Install ==
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# apt install sslh		$ sudo apt install sslh
	</syntaxhighlight>When it ask you how sslh should be run, choose <code>standalone</code>.		</syntaxhighlight>When it ask you how sslh should be run, choose <code>standalone</code>.

Line 55:		Line 55:

	and manually activate it with<syntaxhighlight lang="console">		and manually activate it with<syntaxhighlight lang="console">
	# nft -f /etc/nftables/sslh.conf		$ sudo nft -f /etc/nftables/sslh.conf
	</syntaxhighlight>		</syntaxhighlight>

Line 91:		Line 91:
	ExecStopPost=/sbin/ip route del table 0x4155		ExecStopPost=/sbin/ip route del table 0x4155
	</syntaxhighlight>If using the <code>Capabilities=</code> rule for systemd 228-, you need to give the binary some capabilities as well<syntaxhighlight lang="console">		</syntaxhighlight>If using the <code>Capabilities=</code> rule for systemd 228-, you need to give the binary some capabilities as well<syntaxhighlight lang="console">
	# setcap cap_net_bind_service,cap_net_admin+ei /usr/sbin/sslh-select		$ sudo setcap cap_net_bind_service,cap_net_admin+ei /usr/sbin/sslh-select
	</syntaxhighlight>Next edit file <code>/etc/default/sslh</code><syntaxhighlight lang="shell">		</syntaxhighlight>Next edit file <code>/etc/default/sslh</code><syntaxhighlight lang="shell">
	# Default options for sslh initscript		# Default options for sslh initscript
Line 122:		Line 122:
	=== Start ===		=== Start ===
	You can now restart Nginx and start sslh<syntaxhighlight lang="console">		You can now restart Nginx and start sslh<syntaxhighlight lang="console">
	# systemctl reload nginx && systemctl start sslh		$ sudo systemctl reload nginx && systemctl start sslh
	</syntaxhighlight>		</syntaxhighlight>
	[[Category:Linux Server]]		[[Category:Linux Server]]

Vincent: page title

2016-08-06T02:08:31Z

page title

← Older revision		Revision as of 02:08, 6 August 2016
Line 1:		Line 1:
			{{DISPLAYTITLE:sslh installation guide}}
	{{Debian}}[http://www.rutschle.net/tech/sslh.shtml sslh] is a program that allows you to run several programs on port 443. Mainly it allows your [[SSH\|SSH server]] and [[Nginx\|web server]] to share the same port.		{{Debian}}[http://www.rutschle.net/tech/sslh.shtml sslh] is a program that allows you to run several programs on port 443. Mainly it allows your [[SSH\|SSH server]] and [[Nginx\|web server]] to share the same port.

Vincent: switch to nftables, don't run as root

2016-03-29T21:43:36Z

switch to nftables, don't run as root

Show changes

Vincent: Don't override system files

2016-03-28T17:15:24Z

Don't override system files

← Older revision		Revision as of 17:15, 28 March 2016
Line 73:		Line 73:

	=== sslh ===		=== sslh ===
	~~Edit~~ file <code>/~~lib~~/systemd/system/sslh.service</~~code> and change <code>/usr/sbin/sslh~~</code> ~~to <code>/usr/sbin/sslh-select</code>. Here is the file after modification~~<syntaxhighlight lang="ini">		Create file <code>/etc/systemd/system/sslh.service.d/override.conf</code><syntaxhighlight lang="ini">
	~~[Unit]~~
	~~Description=SSL/SSH multiplexer~~
	~~After=network.target~~

	[Service]		[Service]
	~~EnvironmentFile~~=~~/etc/default/sslh~~		ExecStart=
	ExecStart=/usr/sbin/sslh-select --foreground $DAEMON_OPTS		ExecStart=/usr/sbin/sslh-select --foreground $DAEMON_OPTS
	~~KillMode=process~~		</syntaxhighlight>Next edit file <code>/etc/default/sslh</code><syntaxhighlight lang="shell">

	~~[Install]~~
	~~WantedBy=multi-user.target~~
	</syntaxhighlight>Next edit file /etc/default/sslh<syntaxhighlight lang="shell">
	# Default options for sslh initscript		# Default options for sslh initscript
	# sourced by /etc/init.d/sslh		# sourced by /etc/init.d/sslh

Vincent: Vincent moved page Sslh to sslh

2016-03-28T09:53:04Z

Vincent moved page Sslh to sslh

← Older revision		Revision as of 09:53, 28 March 2016
(No difference)

Vincent: Sslh => sslh

2016-03-28T09:52:40Z

Sslh => sslh

← Older revision		Revision as of 09:52, 28 March 2016
Line 1:		Line 1:
	{{Debian}}{{WIP}}		{{Debian}}{{WIP}}
	~~Sslh~~ is a program that allows you to run several programs on port 443. Mainly it allows your [[SSH\|SSH server]] and [[Nginx\|web server]] to share the same port.		sslh is a program that allows you to run several programs on port 443. Mainly it allows your [[SSH\|SSH server]] and [[Nginx\|web server]] to share the same port.

	{{Warning}}Using SSH can be a violation of your corporate internet use policy. Please act responsibly. In particular, '''never ever create a reverse tunnel''' from your company network. Also this tool is not disguising SHH traffic as web but simply changing the port and can be easily detected by your network administrator.		{{Warning}}Using SSH can be a violation of your corporate internet use policy. Please act responsibly. In particular, '''never ever create a reverse tunnel''' from your company network. Also this tool is not disguising SHH traffic as web but simply changing the port and can be easily detected by your network administrator.
Line 10:		Line 10:

	== Configure ==		== Configure ==
	~~Sslh~~ has several modes of operation. In this tutorial, we will use transparent mode without forks.		sslh has several modes of operation. In this tutorial, we will use transparent mode without forks.

	=== OpenSSH ===		=== OpenSSH ===
Line 72:		Line 72:
	</syntaxhighlight>		</syntaxhighlight>

	=== ~~Sslh~~ ===		=== sslh ===
	Edit file <code>/lib/systemd/system/sslh.service</code> and change <code>/usr/sbin/sslh</code> to <code>/usr/sbin/sslh-select</code>. Here is the file after modification<syntaxhighlight lang="ini">		Edit file <code>/lib/systemd/system/sslh.service</code> and change <code>/usr/sbin/sslh</code> to <code>/usr/sbin/sslh-select</code>. Here is the file after modification<syntaxhighlight lang="ini">
	[Unit]		[Unit]

Vincent at 09:51, 28 March 2016

2016-03-28T09:51:20Z

← Older revision		Revision as of 09:51, 28 March 2016
Line 7:		Line 7:
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# apt install sslh		# apt install sslh
	</syntaxhighlight>		</syntaxhighlight>When it ask you how sslh should be run, choose <code>standalone</code>.

	== Configure ==		== Configure ==
Line 54:		Line 54:
	[Service]		[Service]
	Type=oneshot		Type=oneshot
			RemainAfterExit=yes
	ExecStart=/usr/local/sbin/sslh_network.sh		ExecStart=/usr/local/sbin/sslh_network.sh

Line 107:		Line 108:
	* <code>DAEMON=/usr/sbin/sslh-select</code> Use the no-fork version		* <code>DAEMON=/usr/sbin/sslh-select</code> Use the no-fork version
	* <code>-n</code> Don't resolve domain name of connecting ip in logs. This allow to not loose time doing a DNS lookup for each new client		* <code>-n</code> Don't resolve domain name of connecting ip in logs. This allow to not loose time doing a DNS lookup for each new client
	* <code>--transparent</code> SSH and webserver will see connection as if it where coming directly from ~~them~~. In particular, you will get the correct connecting IP address in the logs.		* <code>--transparent</code> SSH and webserver will see connection as if it where coming directly from the outside. In particular, you will get the correct connecting IP address in the logs.
	* <code>--listen 203.0.113.23:443</code> IP and port sslh listen to		* <code>--listen 203.0.113.23:443</code> IP and port sslh listen to
	* <code>--tls 203.0.113.23:4433</code> IP and port of Nginx		* <code>--tls 203.0.113.23:4433</code> IP and port of Nginx