sslh 1.14

sslh is a simple Perl script that allows you to switch incoming connection between SSH and SSL/HTTPS servers.

SYNOPSIS

sslh [ -v ] [ -p [host:]port ] [ -t timeout ] [ --ssh [host:]port ] [ --ssl [host:]port ]

sslh is a simple script that lets you switch an incoming connection on a single port between distinct SSH and SSL/HTTPS servers.

sslh listens for connections on a port and is able to redirect them either to an HTTPS web server or a SSH server.

This lets one setup both a HTTPS web server and a SSH server and access them through the same host+port.

OPTIONS

The program follows the usual GNU command line syntax, with long options starting with two dashes.

-p, --port [host:]port

The port the proxy will listen to. If no port is given, 443 is used by default. If no host is given, localhost is used by default.
-s, --ssh [host:]port

The SSH server which the SSH connections must be forwarded to. If omitted, the default is localhost:22.
-l, --ssl, --https [host:]port

The HTTPS server which the HTTPS connections must be forwarded to. If omitted, the default is localhost:443.
-t, --timeout delay

Timeout in seconds before a silent incoming connection is considered as a SSH connection. The number can be fractional.

The default is 2seconds.
-v, --verbose

Verbose output. This option can be used several times for more verbose output.

EXAMPLE OF USE

Is this tool actually useful? Yes.

For example one can use it to access both a SSH server and a secure web server via a corporate proxy that only accepts to relay connections to port 443. Creating a tunnel that passes SSH connection through a CONNECT-enabled web proxy is easy with connect-tunnel (also included in the Net::Proxy distribution).

The proxy will let both SSH and HTTPS connections out (since they all point to port 443), and the home server will connect those incoming connections to the appropriate server. This only requires to run the HTTPS server on a non standard port (not 443).


Product's homepage

Requirements:

· Perl

What's New in This Release: [ read full changelog ]

· The OpenVPN probe has been corrected to support pre-shared secret mode (the OpenVPN port-sharing code is wrong).
· New features include an actual TLS/SSL probe, a configurable --on-timeout protocol specification, and an --anyprot protocol probe (equivalent to what --ssl was).
· Makefile now respects the user's compiler and CFLAG choices (falling back to the current values if undefined), as well as LDFLAGS. "After" and "KillMode" have been added to systemd.sslh.service.
· Standard LSB tags have been added to etc.init.d.sslh.