corkscrew is quite good for tunning SSH through an HTTP proxy. However, it only supports basic authentication. Have other people developed similar software supporting other types of authentications? The search engine didn't give me many useful results and I'm wondering whether there are any security implications here (for not implementing such tools).


So, the auth method used by corkscrew is only meant to auth you against your proxy. Not to auth you against the service you want to tunnel.

Have other people developed similar software supporting other types of authentications?

I'll make a list of the other types of HTTP authentications:

  1. digest auth


I've not met an digest-authing HTTP proxy myself, but I'm sure they exist somewhere, somehow. Anyway, it seems to me, you're the first person to actually need this – so, go and add that feature to the full 291 lines of C code that corkscrew 2.0 has. Shouldn't be that hard :)

Personally, I don't understand why anyone would mandate a HTTP proxy but then allow HTTP CONNECT that allows things that aren't HTTPS. That's really like putting a lock on a door, but at the second time, installing an equally-sized second door next to the first door, unlocked.

  • Nice to meet you again. I think you probably forgot things such as NTLM? msdn.microsoft.com/en-us/library/ms789031(v=vs.110).aspx – Cyker Nov 30 '16 at 12:13
  • As for the last paragraph, I think it's because they have to allow for HTTPS but since it's HTTPS they cannot really know what's inside. That's why end-to-end security is great. – Cyker Nov 30 '16 at 12:15
  • Yes, but having an effective proxy and providing end-to-end encryption is simply not possible at the same time. Thus you could simply let your users directly access the servers instead of harassing them to use a proxy. – Marcus Müller Nov 30 '16 at 12:16
  • Sometimes the problem is exactly no direct access from client to server and we need a proxy to make a channel and end-to-end security to make a secure channel. – Cyker Nov 30 '16 at 12:18
  • and, true, I didn't list NTLM, because it's typically a hassle to set up, and has been proven to be insecure decades ago, and thus, you practically don't even find it in intranets anymore. People have long moved to HTTPS + Kerberos/Active Directory for Windows Domain intranet websites that need auth. – Marcus Müller Nov 30 '16 at 12:19

You've dismissed NTLM in the comments but in fact this is still one of the most common scenarios in corporate environments due to the use of Microsoft Proxy.

CNTLM is a tool that will let you tunnel through Microsoft Proxies. Maybe NTLMAPS might be another.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.