The sys admin's daily grind — Corkscrew
Dork Holiday

Sys admin columnist Charly never takes a vacation from the Internet. A beach bar with WiFi is quickly found, but it runs a forced proxy, which thinks that the SSH port (22) is in league with the devil and blocks the connection. Time to drill a tunnel.
The right tool for tunneling SSH through a proxy like Squid, Gauntlet, CacheFlow, Junkbuster, or Apache mod_proxy is Corkscrew. Why? Because the name corkscrew is well chosen, and because the program author introduces himself like this: "My name is Pat Padgett. I'm a dork." In my experience, such laconic people are great programmers.
Most distros have a Corkscrew in a back drawer somewhere; if not, you can pick it up online [1]. The SSH daemon should be running on port 443 on the target server, because many proxies refuse to connect to port 22. Incidentally, binding the SSH daemon to two or more ports simultaneously is not a problem. To do this, you just add another port line to your sshd_config
:
[...] Port 22 Port 443
If you are already running HTTPS on port 443, you can set up SSLH [2] on your server as a last resort. This is an SSH/SSL multiplexer that makes it possible to operate SSH and HTTPS simultaneously on port 443.
If the proxy asks for login credentials, you need to store them in a file. Its name does not matter; I would use, say, /home/charly/.proxy-auth
. Then, you can populate the file with data as follows: <Username>:<Password>
Getting Corked
Now you have to talk your SSH client into using Corkscrew. Edit the .ssh/config
file in your home directory for this. (If it does not exist, simply create it.) You will be adding two lines:
Host * ProxyCommand corkscrew <myproxy.example.net> <3128>%h %p /home/<charly>/.proxy-auth
Of course, you need to change <myproxy.example.net>
and the port number to suit your local situation. The variables %h
and %p
pass the parameters from the SSH call to Corkscrew. If you use a server without authentication, you just leave out the path to the username/password file.
Now, it's time for the premiere. The target server I use is a Raspberry Pi, whose sshd
listens on port 443. The proxy is a standard Squid. As you can see from Figure 1, the login works fine – there is nothing to suggest that Corkscrew has a hand in the game, unless someone has access to the proxy logs. You would find the following entry, if you looked:

"CONNECT 10.0.0.5:443 HTTP/1.0" 200 <[...]>
But, who cares about logs while you're relaxing in a beach bar? Ah, they have WiFi.
Charly Kühnast
Charly Kühnast is a Unix operating system administrator at the Data Center in Moers, Germany. His tasks include firewall and DMZ security and availability. He divides his leisure time into hot, wet, and eastern sectors, where he enjoys cooking, freshwater aquariums, and learning Japanese, respectively.
Infos
- Corkscrew: http://www.agroman.net/corkscrew/
- "The sys admin's daily grind: sslh" by Charly Kühnast, Linux Magazine, Issue 111, 2010: http://www.linux-magazine.com/Issues/2010/111/Charly-s-Column/(language)/eng-US
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Direct Download
Read full article as PDF:
Price $2.95
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
News
-
An All-Snap Version of Ubuntu is In The Works
Along with the standard deb version of the open-source operating system, Canonical will release an-all snap version.
-
Mageia 9 Beta 2 Ready for Testing
The latest beta of the popular Mageia distribution now includes the latest kernel and plenty of updated applications.
-
KDE Plasma 6 Looks to Bring Basic HDR Support
The KWin piece of KDE Plasma now has HDR support and color management geared for the 6.0 release.
-
Bodhi Linux 7.0 Beta Ready for Testing
The latest iteration of the Bohdi Linux distribution is now available for those who want to experience what's in store and for testing purposes.
-
Changes Coming to Ubuntu PPA Usage
The way you manage Personal Package Archives will be changing with the release of Ubuntu 23.10.
-
AlmaLinux 9.2 Now Available for Download
AlmaLinux has been released and provides a free alternative to upstream Red Hat Enterprise Linux.
-
An Immutable Version of Fedora Is Under Consideration
For anyone who's a fan of using immutable versions of Linux, the Fedora team is currently considering adding a new spin called Fedora Onyx.
-
New Release of Br OS Includes ChatGPT Integration
Br OS 23.04 is now available and is geared specifically toward web content creation.
-
Command-Line Only Peropesis 2.1 Available Now
The latest iteration of Peropesis has been released with plenty of updates and introduces new software development tools.
-
TUXEDO Computers Announces InfinityBook Pro 14
With the new generation of their popular InfinityBook Pro 14, TUXEDO upgrades its ultra-mobile, powerful business laptop with some impressive specs.