我需要实现一个从客户端到服务器的反向隧道。我使用了JSCH库,并使用以下命令:
session.setPortForwardingR(rport, lhost, lport);
它可以正常工作(另请参阅JSCH Java实现的反向SSH隧道)!
下一步,我需要通过HTTPS流进行双向认证来隧道我的SSH会话:
client -> firewall -> apache https -> ssh server ----------------------> HTTPS ====================================> SSH ---------------------->
我正在寻找以下内容的小段Java代码:
- 将SSH封装成HTTPS
- 2路HTTPS认证
- APACHE配置
可能的解决方案如下:
1) HTTPS隧道
- JHTTPTunnel,但它基于J2ME,不支持SSL(请参阅Java Http Tunneling,是否有用于通过HTTP发送二进制数据的Java库,HTTP隧道?)
- JOD,但它不支持SSL
3) APACHE配置
- 也许这个配置可以工作,但我需要试一下
## Load the required modules.
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
## Listen on port 8443 (in addition to other ports like 80 or 443)
Listen 8443
<VirtualHost *:8443>
ServerName youwebserver:8443
DocumentRoot /some/path/maybe/not/required
ServerAdmin admin@example.com
## Only ever allow incoming HTTP CONNECT requests.
## Explicitly deny other request types like GET, POST, etc.
## This tells Apache to return a 403 Forbidden if this virtual
## host receives anything other than an HTTP CONNECT.
RewriteEngine On
RewriteCond %{REQUEST_METHOD} !^CONNECT [NC]
RewriteRule ^/(.*)$ - [F,L]
## Setup proxying between youwebserver:8443 and yoursshserver:22
ProxyRequests On
ProxyBadHeader Ignore
ProxyVia Full
## IMPORTANT: The AllowCONNECT directive specifies a list
## of port numbers to which the proxy CONNECT method may
## connect. For security, only allow CONNECT requests
## bound for port 22.
AllowCONNECT 22
## IMPORTANT: By default, deny everyone. If you don't do this
## others will be able to connect to port 22 on any host.
<Proxy *>
Order deny,allow
Deny from all
</Proxy>
## Now, only allow CONNECT requests bound for kolich.com
## Should be replaced with yoursshserver.com or the hostname
## of whatever SSH server you're trying to connect to. Note
## that ProxyMatch takes a regular expression, so you can do
## things like (kolich\.com|anothersshserver\.com) if you want
## to allow connections to multiple destinations.
<ProxyMatch (kolich\.com)>
Order allow,deny
Allow from all
</ProxyMatch>
## Logging, always a good idea.
LogLevel warn
ErrorLog logs/yourwebserver-proxy_error_log
CustomLog logs/yourwebserver-proxy_request_log combined
</VirtualHost>