A Linux daemon that multiplexes SSH and HTTP/HTTPS traffic on a single port, enabling SSH access through firewalls that only allow web traffic.
sshttp is a Linux-based daemon that multiplexes SSH and HTTP/HTTPS traffic on a single port, allowing SSH access through firewalls that only permit web traffic. It acts as a layer-5 switch, inspecting incoming connections and routing them to the appropriate backend service (SSH or web server) without requiring changes to client or server software.
System administrators and network engineers who need to provide SSH access to servers behind restrictive firewalls that only allow HTTP/HTTPS traffic, particularly in DMZ or internal network environments.
Developers choose sshttp because it provides a transparent, high-performance solution for bypassing firewall restrictions without modifying existing infrastructure, using Linux-specific optimizations for efficiency and supporting advanced features like SNI-based routing and multi-core processing.
SSH/HTTP(S) multiplexer. Run a webserver and a sshd on the same port w/o changes.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses zero-copy optimization with the splice(2) system call to avoid costly user-kernel data copies, enhancing throughput on heavily loaded servers, as detailed in the splice branch.
Leverages IP_TRANSPARENT and nf_conntrack to pass original client IP addresses to backend services, maintaining audit trails without modifying server software.
Supports HTTPS Server Name Indication to route traffic to different backend ports based on domain names, enabling multi-service hosting with multiple -N switches.
Can run as an unprivileged user inside a chroot jail when compiled with capability support, reducing attack surface, as configured via -U and -R switches.
Requires specific Linux kernel features like IP_TRANSPARENT and nf_conntrack modules, making it incompatible with other operating systems, a limitation acknowledged in the README.
Installation involves editing and running error-prone netfilter scripts (e.g., nf-setup), which can lock out access if misconfigured, especially on remote hosts.
Only multiplexes SSH with HTTP, HTTPS, or SMTP; cannot handle other protocols without modifications, as the README lists specific protocol pairs with no extensibility mentioned.