Not able to do ssh over http :(

anillohchab007 · 11-24-2007, 07:59 AM

I want to ssh to my departmental web server(having debian running) through http from my flat on my PC (having ubuntu 7.10).

pinging is also not working says timed out.
Same for ssh.

But i am still able to open our departmental site.

Cant able to find any help by googling.

Can any body help me on this....

acid_kewpie · 11-24-2007, 08:02 AM

what have you done to do ssh over http? you don't appear to have attempted anythign to tunnel through it at all...

anillohchab007 · 11-24-2007, 08:09 AM

Quote:

Originally Posted by acid_kewpie

what have you done to do ssh over http? you don't appear to have attempted anythign to tunnel through it at all...

actually ping is not working....

then what else can i try....

can u suggest then i can say i've tried or not.

i've changed IP tables.
n port 22->80 etc.
but no result.

I dont get anything dats why i post dis thread

jschiwal · 11-24-2007, 08:13 AM

There are ssh web clients, but they provide a regular ssh client that connects to your server on port 22. A regular ssh client would do the same thing, so you don't gain anything.

Does the server run an ssh server? Does the server use a non-standard port?
Is the port used forwarded to the server or dropped by the firewall?

Run the ssh client with the verbose option. This might indicate the problem.

You could use telnet to connect to the ssh port. This won't create an ssh session, but you can see what the response is:

Code:

> telnet hpmedia 22
Trying 192.168.1.105...
Connected to hpmedia.
Escape character is '^]'.
SSH-2.0-OpenSSH_4.6

This is a good quick test to see if the firewall might be blocking the attempt.

acid_kewpie · 11-24-2007, 10:33 AM

ping not working has nothing whatsoever to do with tunneling over ssh at all. have a look at tools like stunnel and httptunnel to do this.

anillohchab007 · 11-24-2007, 12:37 PM

Quote:

Originally Posted by jschiwal

There are ssh web clients, but they provide a regular ssh client that connects to your server on port 22. A regular ssh client would do the same thing, so you don't gain anything.

Does the server run an ssh server? Does the server use a non-standard port?
Is the port used forwarded to the server or dropped by the firewall?

Run the ssh client with the verbose option. This might indicate the problem.

You could use telnet to connect to the ssh port. This won't create an ssh session, but you can see what the response is:

Code:

> telnet hpmedia 22
Trying 192.168.1.105...
Connected to hpmedia.
Escape character is '^]'.
SSH-2.0-OpenSSH_4.6

This is a good quick test to see if the firewall might be blocking the attempt.

I tried
ssh -v root@remote_host
then it shows :
OpenSSH_4.6p1 Debian-5build1, OpenSSL 0.9.8e 23 Feb 2007
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to remote_host [remote_ip] port 22.
debug1: connect to address remote_ip port 22: Connection timed out
ssh: connect to host remote_host port 22: Connection timed out

Similarly when i tried :
telnet remote_host 22
then i get similer result:
Trying remote_ip...
telnet: Unable to connect to remote host: Connection timed out

Can You say anything now What is happening ?

jschiwal · 11-24-2007, 07:05 PM

Do you go through a third party firewall at the flat?
You need to determine where ssh is being blocked.

At work, is the Server in the DMZ or is it used in-house?
Can one access the web server from outside or is it used in house?

If you have your own internet account with an independent ISP, and not from your landlord , then the problem probably is at work. Is your IP address at work an internet IP or a private IP?

You also need to provide details on the web server at work. Does it have a public Internet IP address? At work can you connect to it via ssh? Does it run an ssh server? Is a firewall (either external or the web servers own firewall) dropping or not forwarding your ssh request.

If the webserver is behind a NAT router, even if port 22 is forwarded to the server, are you using the correct IP address. In this case, the server may have a private LAN address you use when in the LAN, but you need to access it using the Public IP address of the NAT router.

acid_kewpie · 11-25-2007, 02:34 AM

What is happening? you don't have acces through a firewlal to the outside world. you posted saying you couldn't access ssh over http. do you actually know what "ssh over http" means? you don't seem to know what that means, let alone using it to your advantage, which you probably easily could...

anillohchab007 · 11-25-2007, 03:26 AM

Quote:

Originally Posted by acid_kewpie

What is happening? you don't have acces through a firewlal to the outside world. you posted saying you couldn't access ssh over http. do you actually know what "ssh over http" means? you don't seem to know what that means, let alone using it to your advantage, which you probably easily could...

I dont know the mean of ssh over http technically means but i do know that here it means that i want to do ssh on my depatrmental web server through net means internet. Do now it make some sense.
So now i think question is clear.

Quote:

Originally Posted by jschiwal

Do you go through a third party firewall at the flat?
You need to determine where ssh is being blocked.

At work, is the Server in the DMZ or is it used in-house?
Can one access the web server from outside or is it used in house?

If you have your own internet account with an independent ISP, and not from your landlord , then the problem probably is at work. Is your IP address at work an internet IP or a private IP?

You also need to provide details on the web server at work. Does it have a public Internet IP address? At work can you connect to it via ssh? Does it run an ssh server? Is a firewall (either external or the web servers own firewall) dropping or not forwarding your ssh request.

If the webserver is behind a NAT router, even if port 22 is forwarded to the server, are you using the correct IP address. In this case, the server may have a private LAN address you use when in the LAN, but you need to access it using the Public IP address of the NAT router.

At flat i've my personal ISP means i am directly connected to net.
and I think NO firewall is there. and for department i am trying the same IP address which if i type it on firefox address browser it take to my
departmental site.
At department i configured iptables which allow all connection to port 22 from anywhere as i think so.
:-)

jschiwal · 11-25-2007, 03:40 AM

I think that ssh over http would require installing some software on the server. It would have the advantage of being very portable if you have a client for your OS. Mostly, it would allow you to use the client if the lan you were on would block port 22. Since you aren't going through another parties firewall I don't think that is the case.

It seems that the router or firewall or server's firewall is blocking port 22 at work and if you solved that problem you could use a regular ssh client like ssh in Linux or Mac or putty or cygwin's ssh client in windows.

anillohchab007 · 11-25-2007, 05:31 AM

Quote:

Originally Posted by jschiwal

I think that ssh over http would require installing some software on the server. It would have the advantage of being very portable if you have a client for your OS. Mostly, it would allow you to use the client if the lan you were on would block port 22. Since you aren't going through another parties firewall I don't think that is the case.

It seems that the router or firewall or server's firewall is blocking port 22 at work and if you solved that problem you could use a regular ssh client like ssh in Linux or Mac or putty or cygwin's ssh client in windows.

as i think it's not blocking ssh.
ok i am showing you the output of iptables -L.

Chain INPUT (policy ACCEPT)
target prot opt source destination
ipac~o all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh

Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- anywhere pratapgad.unipune.ernet.in reject-with icmp-port-unreachable
ipac~fi all -- anywhere anywhere
ipac~fo all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ipac~i all -- anywhere anywhere

Chain ipac~fi (1 references)
target prot opt source destination

Chain ipac~fo (1 references)
target prot opt source destination

Chain ipac~i (1 references)
target prot opt source destination
all -- anywhere anywhere
tcp -- anywhere anywhere tcp dpt:ftp-data
tcp -- anywhere anywhere tcp dpt:ftp
tcp -- anywhere anywhere tcp dpt:ssh
tcp -- anywhere anywhere tcp dpt:telnet
tcp -- anywhere anywhere tcp dpt:smtp
tcp -- anywhere anywhere tcp dpt:domain
udp -- anywhere anywhere udp dpt:domain
tcp -- anywhere anywhere tcp dpt:www
tcp -- anywhere anywhere tcp dpt

op3
tcp -- anywhere anywhere tcp dpts:netbios-ns:netbios-ssn
udp -- anywhere anywhere udp dpts:netbios-ns:netbios-ssn
tcp -- anywhere anywhere tcp dpt:https
tcp -- anywhere anywhere tcp spt:ftp-data
tcp -- anywhere anywhere tcp spt:ftp
tcp -- anywhere anywhere tcp spt:ssh
tcp -- anywhere anywhere tcp spt:telnet
tcp -- anywhere anywhere tcp spt:smtp
tcp -- anywhere anywhere tcp spt:domain
udp -- anywhere anywhere udp spt:domain
tcp -- anywhere anywhere tcp spt:www
tcp -- anywhere anywhere tcp spt

op3
tcp -- anywhere anywhere tcp spts:netbios-ns:netbios-ssn
udp -- anywhere anywhere udp spts:netbios-ns:netbios-ssn
tcp -- anywhere anywhere tcp spt:https

Chain ipac~o (1 references)
target prot opt source destination
all -- anywhere anywhere
tcp -- anywhere anywhere tcp spt:ftp-data
tcp -- anywhere anywhere tcp spt:ftp
tcp -- anywhere anywhere tcp spt:ssh
tcp -- anywhere anywhere tcp spt:telnet
tcp -- anywhere anywhere tcp spt:smtp
tcp -- anywhere anywhere tcp spt:domain
udp -- anywhere anywhere udp spt:domain
tcp -- anywhere anywhere tcp spt:www
tcp -- anywhere anywhere tcp spt

op3
tcp -- anywhere anywhere tcp spts:netbios-ns:netbios-ssn
udp -- anywhere anywhere udp spts:netbios-ns:netbios-ssn
tcp -- anywhere anywhere tcp spt:https
tcp -- anywhere anywhere tcp dpt:ftp-data
tcp -- anywhere anywhere tcp dpt:ftp
tcp -- anywhere anywhere tcp dpt:ssh
tcp -- anywhere anywhere tcp dpt:telnet
tcp -- anywhere anywhere tcp dpt:smtp
tcp -- anywhere anywhere tcp dpt:domain
udp -- anywhere anywhere udp dpt:domain
tcp -- anywhere anywhere tcp dpt:www
tcp -- anywhere anywhere tcp dpt

op3
tcp -- anywhere anywhere tcp dpts:netbios-ns:netbios-ssn
udp -- anywhere anywhere udp dpts:netbios-ns:netbios-ssn
tcp -- anywhere anywhere tcp dpt:https

an i think it is not blocking ssh.
Do u ?

acid_kewpie · 11-25-2007, 09:06 AM

clearly *they* have a firewall. it's about their network, not your local iptables config.

anillohchab007 · 11-25-2007, 11:46 AM

Quote:

Originally Posted by acid_kewpie

clearly *they* have a firewall. it's about their network, not your local iptables config.

this is the iptable configuration for my server to which i want to connect not of my PC.

acid_kewpie · 11-25-2007, 12:21 PM

right, and what's inbetween it? routers? firewalls? NAC appliances?

anillohchab007 · 11-25-2007, 03:42 PM

Quote:

Originally Posted by acid_kewpie

right, and what's inbetween it? routers? firewalls? NAC appliances?

nothing as i think ....
but our server is connected to another server which is inturn connected to internet.
but the ip address for our web server is static.
which is same as the www.whatismyip.com shows.