My colleague just told me he can't make outbound SSH connections in his corporate networks, so I advised him to set up a server on 443 port and it worked. I then started thinking that the administrator could detect that it's actually an SSH connection using deep packet inspection and/or by connecting to the server, but I think I found a way to make it more difficult that does not involve protocol obfuscation (which I don't like, because it would break putty).
While it's obvious that if you don't change the protocol, your connection will stay in the logs, but I thought that the admin could feel confused if I could prove to him that there's actually a HTTPS website on the port and the server doesn't really speak SSH. In order to do the trick, I thought of a proxy that wraps the port and always lets in SSL requests, but lets in SSH only after a secure login attempt over HTTPS. Since I don't yet know the protocols of neither SSL nor SSH, can you think of a reason this couldn't work? If not, do you think it could actually be convincing/useful?