bryanpkc/corkscrew

A tool for tunneling SSH through HTTP proxies

Welcome to Corkscrew

Introduction

Corkscrew is a tool for tunneling SSH through HTTP proxies, but... you might find another use for it.

Corkscrew has been compiled on:

• HPUX
• Solaris
• FreeBSD
• OpenBSD
• Linux
• Win32 (with Cygwin)

Corkscrew has been tested with the following HTTP proxies:

• Gauntlet
• CacheFlow
• JunkBuster
• Apache mod_proxy

Please open a pull request if you get it working on other proxies or compile it elsewhere.

Where Do I Get It?

Corkscrew's primary distribution site was agroman.net/corkscrew, however it seems that the site went down and this repository is here to keep the code available. The new location is then github.com/bryanpkc/corkscrew.

How Do I Install It?

First you need to install development tools:

# For Debian-based distributions (Ubuntu, ElementaryOS, ...)
sudo apt install build-essential

# For Red-Hat-based distributions (CentOS, Fedora, ...)
sudo yum groupinstall 'Development tools'

You need to clone the repo and then you need to go into the corkscrew source directory and run

autoreconf --install
./configure
make
sudo make install

This will compile corkscrew and copy it into /usr/local/bin/corkscrew.

If you want to go more in depth about the configuration, please have a look at the INSTALL file which gives general information about the build system.

How Is It Used?

Setting up Corkscrew with SSH/OpenSSH is very simple. Adding the following line to your ~/.ssh/config file will usually do the trick (replace proxy.example.com and 8080 with correct values):

ProxyCommand /usr/local/bin/corkscrew proxy.example.com 8080 %h %p

NOTE: Command line syntax has changed since version 1.5. Please notice that the proxy port is NOT optional anymore and is required in the command line.

How Do I Use The HTTP Authentication Feature?

You will need to create a file that contains your usename and password in the form of:

username:password

I suggest you place this file in your ~/.ssh directory.

After creating this file you will need to ensure that the proper perms are set so nobody else can get your username and password by reading this file. So do this:

chmod 600 myauth

Now you will have to change the ProxyCommand line in your ~/.ssh/config file. Here's an example:

ProxyCommand /usr/local/bin/corkscrew proxy.work.com 80 %h %p ~/.ssh/myauth

The proxy authentication feature is very new and has not been tested extensively so your mileage may vary. If you encounter any problems when trying to use this feature please email me. It would be helpful if you could include the following information:

• Proxy version (ie. Gauntlet Proxy, Microsoft Proxy Server, etc)
• Operating system you are trying to run corkscrew on
• Command line syntax you are using
• Any error messages that are visible to you

NOTE: I have had problems using the auth features with Mircosoft Proxy server. The problems are sporadic, and I believe that they are related to the round-robin setup that I was testing it again. Your mileage may vary.

Who Contributed?

The main author is Pat Padgett. But none of the contact info left work anymore, so a name is all we have.

Bryan Chan created this repository and tweaked the code a little bit. Then Rémy Sanchez improved the documentation.

corkscrew's Issues

Corkscrew eats 100% of CPU

Hello,
thank you for your time for Corkscrew development. Very useful tool.
Seems, that I found a small bug.
Corkscrew eats 100% of CPU when ssh server unavailable by network problems. There is happens when I receive similar error message from proxy server:
Gateway Timeout
ssh_exchange_identification: Connection closed by remote host

Seems that corkscrew trys reconnecting without any pause, causing proxy flood.

$ corkscrew --help
corkscrew 2.0 ([email protected])
From official repositoies of Ubuntu 18.04

Release tags

Hello @bryanpkc, could you please tag the 2.0 release as imported from http://agroman.net/corkscrew/ and eventually tag a newer release with your commits? This will help the downstream distribution of the software. Thanks!

Corkscrew install from brew has broken Proxy-Authorization

Steps to reproduce:

• Install corkscrew using brew brew install corkscrew
• Create auth file echo user@pass > auth
• Make corkscrew request: corkscrew localhost 8000 localhost 8001 auth
• Header come through like: Proxy-Authorization: Basic Q09OTkVDVCBsb2NhbGhvc3Q6ODAwMSBIVFRQLzEuMApQcm94eS1BdXRob3JpemF0aW9uOiBCYXNpYyA=
• Decoding the auth header:

base64 --decode <<< 'Q09OTkVDVCBsb2NhbGhvc3Q6ODAwMSBIVFRQLzEuMApQcm94eS1BdXRob3JpemF0aW9uOiBCYXNpYyA='
CONNECT localhost:8001 HTTP/1.0
Proxy-Authorization: Basic 

Notes

• It seems like the request headers themselves are being base64 encoded instead of the contents of the auth file.
• I built corkscrew from source and the auth works as expected. Possibly this is as simple as publishing the latest corkscrew to homebrew.

corkscrew --version
corkscrew 2.0 ([email protected])

Thank you this is very useful software for me.

Certificate Based Authentication Works or ??

I have used the debian repo corkscrew and this github version, both give me the same results. I am attempting to ssh to port 443. Server has sshd running on port 443, and my client is using the 'ProxyCommand /opt/corkscrew/corkscrew my.domain 443 %h %p'

It is a certificated based SSH and my certs are valid and work when not trying to use corkscrew.

The ultimate error that I get is:

kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535

Any help would be appreciated.

Connection closed by UNKNOWN port 65535

Hi,

I get stuck in ssh proxy, appreciate for help.

1 OS platform

• macOS 13.5
• arch 6.4.10

2 corkscrew ver

2.0

3 ssh config

❯ cat .ssh/config

# my-github
Host github.com
	Hostname github.com
	IdentityFile ~/.ssh/my_github
	User [email protected]
    ProxyCommand corkscrew 127.0.0.1 7890 %h %p

4 ssh error

4.1 ssh -T

❯ ssh -T [email protected]

kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535

4.2 ssh -v

❯ ssh -v [email protected]

OpenSSH_9.0p1, LibreSSL 3.3.6
debug1: Reading configuration data /Users/dingrui/.ssh/config
debug1: /Users/dingrui/.ssh/config line 2: Applying options for github.com
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: include /etc/ssh/ssh_config.d/* matched no files
debug1: /etc/ssh/ssh_config line 54: Applying options for *
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
debug1: Executing proxy command: exec corkscrew 127.0.0.1 7890 github.com 22
debug1: identity file /Users/dingrui/.ssh/my_github type 0
debug1: identity file /Users/dingrui/.ssh/my_github-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.0
kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535

I hava no ideals on this, i'm looking forward to your suggestions or help, thanks again.

Original Corkscrew ?

FYI, Pat Padgett seems to have surfaced again, I stumbled upon this:
https://github.com/patpadgett/corkscrew

authentication doesn't work with Squid basic auth

Hello,

I am trying to use the auth option, but it doesn't work, unforunatelly, this is all I get, no more verbose errors:

petr.bena@MacBook:~/.ssh$ corkscrew vpn.insw.cz 80 test 1 proxy
Proxy could not open connnection to test:  Proxy Authentication Required

When I try to connect for example via firefox or any other SW that ask me for proxy credentials, I just give it user and password that is written on first line in file "proxy" and it works.

I created that file as instructed it has this format:

user:password