.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.43) .\" .\" Standard preamble: .\" ======================================================================== .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. \*(C+ will .\" give a nicer C++. Capital omega is used to do unbreakable dashes and .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, .\" nothing in troff, for use with C<>. .tr \(*W- .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' . ds C` . ds C' 'br\} .\" .\" Escape single quotes in literal strings from groff's Unicode transform. .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" .\" If the F register is >0, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .\" .\" Avoid warning from groff about undefined register 'F'. .de IX .. .nr rF 0 .if \n(.g .if rF .nr rF 1 .if (\n(rF:(\n(.g==0)) \{\ . if \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . if !\nF==2 \{\ . nr % 0 . nr F 2 . \} . \} .\} .rr rF .\" ======================================================================== .\" .IX Title "SSLH 1p" .TH SSLH 1p "2023-06-26" "perl v5.36.0" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l .nh .SH "NAME" sslh \- Switch incoming connection between SSH and SSL/HTTPS servers .SH "SYNOPSIS" .IX Header "SYNOPSIS" \&\fBsslh\fR [ \fB\-v\fR ] [ \fB\-p\fR \fI[host:]port\fR ] [ \fB\-t\fR \fItimeout\fR ] [ \fB\-\-ssh\fR \fI[host:]port\fR ] [ \fB\-\-ssl\fR \fI[host:]port\fR ] .SH "DESCRIPTION" .IX Header "DESCRIPTION" \&\fBsslh\fR is a simple script that lets you switch an incoming connection on a single port between distinct \s-1SSH\s0 and \s-1SSL/HTTPS\s0 servers. .PP \&\fBsslh\fR listens for connections on a port and is able to redirect them either to an \s-1HTTPS\s0 web server or a \s-1SSH\s0 server. .PP This lets one setup both a \s-1HTTPS\s0 web server and a \s-1SSH\s0 server and access them through the same host+port. .SH "OPTIONS" .IX Header "OPTIONS" The program follows the usual \s-1GNU\s0 command line syntax, with long options starting with two dashes. .IP "\fB\-p\fR, \fB\-\-port\fR \fI[host:]port\fR" 4 .IX Item "-p, --port [host:]port" The port the proxy will listen to. If no port is given, 443 is used by default. If no host is given, \f(CW\*(C`localhost\*(C'\fR is used by default. .IP "\fB\-s\fR, \fB\-\-ssh\fR \fI[host:]port\fR" 4 .IX Item "-s, --ssh [host:]port" The \s-1SSH\s0 server which the \s-1SSH\s0 connections must be forwarded to. If omitted, the default is \fIlocalhost:22\fR. .IP "\fB\-l\fR, \fB\-\-ssl\fR, \fB\-\-https\fR \fI[host:]port\fR" 4 .IX Item "-l, --ssl, --https [host:]port" The \s-1HTTPS\s0 server which the \s-1HTTPS\s0 connections must be forwarded to. If omitted, the default is \fIlocalhost:443\fR. .IP "\fB\-t\fR, \fB\-\-timeout\fR \fIdelay\fR" 4 .IX Item "-t, --timeout delay" Timeout in seconds before a silent incoming connection is considered as a \s-1SSH\s0 connection. The number can be fractional. .Sp The default is \fI2\fRseconds. .IP "\fB\-v\fR, \fB\-\-verbose\fR" 4 .IX Item "-v, --verbose" Verbose output. This option can be used several times for more verbose output. .SH "EXAMPLE OF USE" .IX Header "EXAMPLE OF USE" Is this tool actually useful? Yes. .PP For example one can use it to access both a \s-1SSH\s0 server and a secure web server via a corporate proxy that only accepts to relay connections to port 443. Creating a tunnel that passes \s-1SSH\s0 connection through a CONNECT-enabled web proxy is easy with \fBconnect-tunnel\fR (also included in the \f(CW\*(C`Net::Proxy\*(C'\fR distribution). .PP The proxy will let both \s-1SSH\s0 and \s-1HTTPS\s0 connections out (since they all point to port 443), and the home server will connect those incoming connections to the appropriate server. This only requires to run the \&\s-1HTTPS\s0 server on a non standard port (not 443). .SH "TECHNICAL NOTE" .IX Header "TECHNICAL NOTE" How can this proxy find out what kind of protocol is using a \s-1TCP\s0 connection to port 443, without being connected (yet) to the server? We actually rely on a slight difference between the \s-1SSL\s0 and \s-1SSH\s0 protocols (found thanks to \fBethereal\fR): .IP "\s-1SSH\s0" 4 .IX Item "SSH" Once the \s-1TCP\s0 connection is established, the server speaks first, presenting itself by saying something like: .Sp .Vb 1 \& SSH\-2.0\-OpenSSH_3.6.1p2 Debian 1:3.6.1p2\-1 .Ve .IP "\s-1SSL\s0" 4 .IX Item "SSL" With \s-1SSL,\s0 it's always the client that speaks first. .PP This means that \fBsslh\fR can be used with any pair of protocols/services that share this property (the client speaks first for one and the server speaks first for the other). .SH "AUTHORS" .IX Header "AUTHORS" .IP "Original idea and C version" 4 .IX Item "Original idea and C version" Frédéric Plé \f(CW\*(C`\*(C'\fR. .IP "Perl versions" 4 .IX Item "Perl versions" Philippe 'BooK' Bruhat \f(CW\*(C`\*(C'\fR. .SH "SCRIPT HISTORY" .IX Header "SCRIPT HISTORY" Version 0.01 of the script was a quick hack designed in 2003 as a proof of concept. .PP Version 0.02 (and higher) are based on \f(CW\*(C`Net::Proxy\*(C'\fR, and included with the \f(CW\*(C`Net::Proxy\*(C'\fR distribution. Version 0.02 didn't work, though. .PP Version 0.03 correctly initialised the \f(CW\*(C`in\*(C'\fR connector. .PP Version 0.04 lets the proxy listen on any address (instead of \f(CW\*(C`localhost\*(C'\fR, which is still the default). Thanks to Dieter Voegtli for spotting this. .SH "SEE ALSO" .IX Header "SEE ALSO" Net::Proxy, Net::Proxy::Connector::dual. .SH "COPYRIGHT" .IX Header "COPYRIGHT" Copyright 2003\-2008, Philippe Bruhat. All rights reserved. .SH "LICENSE" .IX Header "LICENSE" This module is free software; you can redistribute it or modify it under the same terms as Perl itself.