SSH hidden on HTTPS
How to hide SSH on HTTPS port 443.
Last updated
How to hide SSH on HTTPS port 443.
Last updated
We have several Servers in the network and a router. 2 Server have an SSH server installed. Now it's obvious to open port 22 on the router for one of the servers. A port like 20022 is also usually chosen for the second server. You quickly notice that strangers are trying to access the SSH server using Brut force.
SSH is already a secure story. With IP auto ban and certificates for the ssh client you are on the safe side.
But a further step would be that strangers wouldn't know where the SSH ports are.
If we don't know the door, we can't break down a door!
Now let's get to the magic. We have an opportunity! We have nginx, and it can split domains from the SSL protocol! SSH uses SSL as the transmission protocol.
Now let’s dig further into our bag of tricks! We need SSH port forwarding. The FlyingFish has an SSH Jump Server integrated. This cannot command any commands, only forward the ports.
So we have the HTTPS port with 443. If a client comes with a special domain, it will be directed to the SSH jump server. This person then knows the appropriate destination in our network using the access data.
To begin, we create a subdomain (the easiest way is to have your own DNS server running). We will call the new subdomain ssh1.example.com as above.
We won't go into the setting of the record now, the subdomain should resolve the IP correctly (A Record).
Likewise, we now create a Route (Stream) for this domain:
This tab is activated if "External ssh server (Stream)" was selected under 6.
Domain Name/IP: Here we can see again under which domain the route is entered.
Listen: We select the list for "Stream SSL EXTERN - 443", because we want to use the SSL on port 443 for our SSH (hide behind the HTTPS).
Index: We leave the index on auto.
Alias-Name (Intern): Any name, I chose "mySSH".
Destination-Type: We want the target to be an “External ssh server (Stream)” which activates the “SSH” tab for us.
Listen Port: The port on which the target SSH server is listed.
Username: Username for the FlyingFish SSH Jump Server.
Password: Password for the username.
Destination IP Address: The IP to the SSH server in your network.
After saving, we can now establish the connection.
A user who is now on the Internet and would like to reach the SSH server in his network now gets the SSH port from his SSH server to his PC via the disguised port on 443 and the domain with port forwarding. The internal FylingFish SSH Jump server takes care of port forwarding with its own user management. In the settings you have stored a user with a password that must be used for this connection.
We open a shell console with the following command:
port1: The port that should be used on your computer (this port must be free).
port2: Any port, actually the SSH server would use this port, but the FlyingFish SSH Jump Server overwrites this port with its own.
username: The username specified above in the settings.
domain: The domain on which the stream was set up.
Our finished example would now look like this:
We can now connect to the SSH server with another console:
