Join us on IRC: #infoanarchy on irc.oftc.net — channel blog

Bring back infoAnarchy, the first site to report on the coming age of abundance. Revive infoanarchy.org blog & wiki - donate BTC to 1J66guL99svkrDzEerVhammM938niMUC5G

Corkscrew

From iA wiki

See also: Anti-Proxy | Privacy | PuTTY

Home Page: http://www.agroman.net/corkscrew/

Corkscrew enables you to run SSH connections over most HTTPS proxy servers. Due to SSH features such as port forwarding, this can allow many types of services to be run safely over the SSH via HTTPS connections.

Supported proxy servers:

One problem with this approach is that proxy servers generally have an idle timeout setup for HTTP/HTTPS connections. Values of 10 minutes or so can possibly be tolerated, but some have this value very low (say 30 seconds). This of course causes your SSH sessions to die after the set timeout if they are left idle.

One way to work around this is to modify the TCP/IP stack keepalive values on the client machine and the machine running the ssh server. Most default keepalives do not kick in until a large amount of time has gone by, however, so this approach would mean modifying the keepalive values on all (outside) machines you want to connect to. Not terribly great.

A good workaround for this problem is to install the heartbeat patch for OpenSSH.

http://www.sc.isc.tohoku.ac.jp/~hgot/sources/openssh-watchdog.html

You can apply this patch on the client machine (the one behind the restrictive firewall/proxy) and then setup a heartbeat for every 15 seconds or so, and your connections will not die due to idle timeout. This approach has worked consistently well.

Practical use

One very handy use of this, is to setup squid on a remote machine (outside restrictive firewall), and port forward from your client machine, across said firewall, to the box with squid. Then, you can set your local browser to use the local port as it's proxy server, and you can have all of your web traffic be unreadable to the firewall.

Assume that squid is configured on remotehost to listen on 127.0.0.1:8080.

To start ssh port forward:

ssh -L 8080:127.0.0.1:8080 remotehost.com

Then, just have your browser use 127.0.0.1:8080 as it's proxy server, and you are set. Refer to the squid page for information on anonymizing you can have squid automatically do for your HTTP traffic.

To share your new proxy with friends on your local network use the -g option (gateway?)

ssh -g -L 8080:127.0.0.1:8080 remotehost.com 


Notes

These examples are primarily targeted at *NIX users, for a simple solution on a Windows platform, consider PuTTY.