Apache2 和 SSH。两者都在相同的IP和端口上
我的问题可能有点令人困惑，但无论如何。我的学校打算在单独的 IP 上为学生开放 WiFi DMZ，但他们说端口 80 将是唯一开放的端口。
我想要什么？好吧，我想通过我的家庭服务器传输流量，该服务器在 80 上运行 Apache2，在 21 上运行 SSH。这只是常规设置。由于它是一台生产机器，我希望客户端能够连接到端口 80，但我想连接到端口 80 以建立隧道。问题是：如何做到这一点？
可能的解决方案：放弃从学校IP连接到服务器上运行的网站的可能性，并使用IPTABLES。如果源ip == $school_ip && port == 80：重定向到端口 21。完成。但我认为必须有另一种优雅的解决方案...是否可以实际使用 HTTP 传输进行 SSH 传输？我的意思是创建一个名为 ssh.mydomain.tld 的主机，并使用一些 apache 模块对端口 21 进行服务器端重定向，但仅在该特定主机名上？我能做些什么？
Box 正在运行 Debian GNU/Linux
感谢您的帮助...
题外话：他们认为他们会阻止任何类型的非法操作。事实上，HTTP 可能是仅次于 BitTorrent 的第二个最容易受到攻击的协议。为什么不把它也锁起来呢？如果没有开放的端口那就绝对安全了，不是吗？我个人认为阻止 POP、IMAP、Jabber 等端口没有任何好处。我认为，如果他们甚至无法打开老师发给他们的邮件，他们可能会严重惹恼某人。哦，有网络邮件吗？不不不！ SSL/TLS 运行在端口 443 上，还记得吗？我不认为封锁所有交通会有什么好处。在我看来，他们应该阻止未加密的 BitTorrent 并对非机密传输应用低优先级 QoS。
My question may be a little confusing, but anyway. My school is going to open up WiFi DMZ on separate IP for students, but they said port 80 will be the only port open.
What do I want? Well I want to tunnel my traffic thru my home server, which is running Apache2 on 80 and SSH on 21. It's just a regular setup. As it is a production machine and I want clients to be able to connect on port 80, but I want to connect to port 80 to make a tunnel. The question is: How to do that?
The possible sollution: Abandon possibility of connecting to websites running on the server from the school IP and use IPTABLES. If source ip == $school_ip && port == 80: Redirect to port 21. Done. But I think there must another, elegant sollution... Isn't it possible to actually use the HTTP transfer for SSH transit? I mean create a host named for example ssh.mydomain.tld and use some apache module to do a server-side redirection to port 21 but only on that particular hostname? What can I do?
Box is running Debian GNU/Linux
Thanks for any help...
Off topic: They think they will block any sort of illegal operation. In fact HTTP is probably the second most-vulnerable protocol after BitTorrent. Why don't lock it down too? It'll be absolutely safe if there's no open ports, wouldn't it? I don't personally think blocking ports for POP, IMAP, Jabber, etc is any good. I think they'll probably seriously piss someone off if they even can't open mail teacher sent them. Oh, there's a webmail? No no no! SSL/TLS goes on port 443, remember? I don't think blocking all the traffic will be any good. IMO they should block unencrypted BitTorrent and apply low-priority QoS for unclassified transfers.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可以尝试此处的说明：
http://dag.wieers.com/howto/ssh-http-tunneling/
proxytunnel 在稳定仓库中可用：
http://packages.debian.org/search ?keywords=proxytunnel&searchon=names&suite=stable§ion=all
You could try the instructions found here:
http://dag.wieers.com/howto/ssh-http-tunneling/
proxytunnel is available in the stable repo:
http://packages.debian.org/search?keywords=proxytunnel&searchon=names&suite=stable§ion=all
一个简单且可行的解决方案是 sslh。
它正是解决该问题的工具。
BTW ssh 通常设置在端口 22 上。
A simple and working solution is sslh.
It is exactly the tool to solve that problem.
BTW ssh is usually set on port 22.