Forem: Daniele Cruciani

ssh over https

Daniele Cruciani — Wed, 11 Jun 2025 18:32:03 +0000

By the mean of a reverse proxy installed on a Proxmox machine, is possible to expose also ssh access to the single machine.

List of ingredients

A real PC with Proxmox installed, acting as "The Server"

A real PC with an OS installed (OSX, Linux, or Win works), acting as "The Client"

A LAN where both The Server, and The Client are attached to

nginx and nginx-stream-module running on The Server

A VNET defined in Proxmox with CIDR 10.4.1.1/24, acting as "vmnet"

Some VMs defined in Proxmox, each of those VMs with:

OS installed (Linux)

ssh-server running and exposing port 22

attached to the internal vmnet

Choose a name for VMs domain, say ".fundom": each vm will be reachable from The Client by "ssh vm1.fundom", "ssh vm2.fundom", etc.

Preparing The Server

Install Proxmox, community edition is enough

Setup a VNET on Proxmox: in Datacenter -> SDN -> VNets hit "Create", and call it "vmnet"

Create a subnet class for the created vnet: in Datacenter -> SDN -> VNets selects the created vnet, and on Subnets hit "Create". The subnet CIDR is 10.4.1.1/24 and has 10.4.1.1 as gateway

Create some VMs: in Datacenter -> pve on top right hit "Create VM" or "Create CT" then clone VMs

To each VM, Hardware -> Add -> Network Device, and select vmnet for it

For each VM, assign an IP in "Cloud-Init" for vmnet device

For each VM, in Cloud-Init, setup an user and load its public key for ssh

Open a shell into The Server and run apt install nginx libnginx-mod-stream

Setup in /etc/nginx/nginx.conf a stream { ... } section that defines how to reverse proxy by SNI to the target VMs (vm1.fundom, vm2.fundom, etc.)

Generate a self-signed certificate for the SSL of nginx, and refers to it inside nginx configuration

reload nginx configuration by systemctl reload nginx

To generate an self signed certificate, use the command:

mkdir /etc/nginx/ssl
cd /etc/nginx/ssl
openssl req -x509 -newkey rsa:4096 -keyout self.key -out minihost.crt -sha256 -days 365

In /etc/nginx/nginx.conf add these lines:

stream {
ssl_preread on;

    map $ssl_server_name $ssh_backend {
    ## these are the vm running on VNET settled by Proxmox in this machine
            ~^vm1\.fundom$ 10.4.1.11:22;
            ~^vm2\.fundom$ 10.4.1.12:22;
            default unix:/run/nginx-blackhole.sock; # just a way to drop anything else
    }
    server {
            listen 443 ssl;
            proxy_pass $ssh_backend;
            ssl_preread on;
            ssl_certificate /etc/nginx/ssl/self.crt;
            ssl_certificate_key /etc/nginx/ssl/self.key;
            ssl_protocols TLSv1.2 TLSv1.3;
    }

}

Preparing The Client

install ssh client

install openssl utility

copy the self signed certificate from The Server

setup .ssh/config with ProxyCommand

Copying minihost.crt in The Client from The Server by:

scp root@192.168.1.10:/etc/nginx/ssl/minihost.crt ~/minihost.crt

Where 192.168.1.10 is The Server's IP, i.e. where Proxmox and nginx are running

The .ssh/config file is

Host *.fundom
ProxyCommand openssl s_client -quiet -verify_quiet -CAfile ~/minihost.crt -servername %h -connect 192.168.1.10:443

where:

s_client subcommand creates an SSL tunnel with client negotiation

say to be quiet about errors

indicate as CAfile minihost.crt, copied from the self-signed certificate used by nginx in The Server

uses as SNI (-servername) the hostname %d matched by wildcard *.fundom in Host line above

-connect to the IP of The Server 192.168.1.10 to port 443, the default port for HTTPS

Behind the scene

With this setup is now possible from The Client do:

ssh user@vm1.fundom

Where 'user' is the username defined in the internal VM, that is ran by Proxmox

This is what is happening:

From The Client machine, ssh use openssl s_client to setup an ssl channel that negotiate a connection as vm1.fundom

nginx server match the SNI vm1.fundom as stream to 10.4.1.11 on port 22

The Server has access to both 192.168.1.1/xx interface and 10.4.1.1/24 vnet.

after verifying the CA signature, the stream of data is sent to the target VM by the route

Features

This technic does not expose internal VMs to the LAN, but just some selected services, and also some selected VMs, if desired.

Exposing to the wide internet

It is possible to expose this service on internet, by routing from the outgoing router to the 443 port of the Proxmox server.

In this way, one can just expose a regular https port, but still be able to use ssh shell to work on a given VM.

Some ISP, and some government are blocking port 22, or just blocking SSH traffic, because it is secure and someway suspect. But by exposing SSL on 443 you can overcome this kind of limitation.

SSL connection add another level of security, by adding a certificate verification, so your client can be sure to talk to the right server, even when you update the ssh certificate, or reinstall the VMs as new.

Just one port

I shared the video in social, and I received complains because "this is not ssh tunnel", and the suggestion is to use https://linuxize.com/post/how-to-setup-ssh-tunneling/ that describe ssh -L ... class of commands. This command can open a port exposed on the proxmox server that points directly to each VM. Some drawbacks of ssh -L:

This requires to open as many port as there are VMs to be mapped/exposed

The admin of the proxmox server must have access to each VM, through ssh, via public key, or by password

It selects a single user, or if more user want to access to a VM, each user must have his own port

Other option can be to let each user "hop" on Proxmox ssh server, then go inside the VM's ssh. Drawbacks:

User who want to access internal VM must have also access to the Proxmox's VM

Further improvement

An additional level of security can be implemented by switching to UDP as soon as both side (VM and Client in this case) are ready

Using UDP is a common practice for most of the VPN implementation, i fact the port is automatically NATed from the receiving side (The VM), and for the talking side (The Client).

Also MOSH had stability in case of low-quality connection, or connection switching

I made a video presenting this staff.

Source of some schema are on https://github.com/danielecr/selfhosted/tree/main/ssh-tunnel-https

skiplist implementation

Daniele Cruciani — Mon, 16 Sep 2024 11:52:55 +0000

I share here my skiplist implementation. It is a good idea to keep in trained on C language.

#include <stdlib.h>
#include <stdio.h>
#include <stdarg.h>

#define LOGLEVEL 3

// a skip list is made of a single linked where each element has an
// array of pointers to the next element of the same level.
// I will name `level_pointer` the array of pointers,
// for each element "e" in the list e.level_pointer[n] points to
// the next element "e1" at the same level.
// Every pointer with m smaller than n, the e.level_pointer[m] points
// to an element "e2" such that e <= e2 <= e1
// and if it exists an element e4 with maxlevel>=m such that
// e <= e4 <= e2 then e4==e2
// with <= the order function defined between the elements.
// That implies that at level 0 each level_pointer represent
// a regular ordered linked list.
// The advance of skiplist is to consider the higher level to
// skip to the position where the element should be placed or
// looked at.
// Assuming the element is a pointer to the real element (so void *)
// a skiplist can be modelled by using a data structure like this

typedef struct skiplist {
    void *element;
    // skiplist specific fields
    int maxlevel;
    struct skiplist ** level_pointer;
} Skiplist;

// I define here a container as a main access point to the list.
// It has basically 3 fields:
typedef struct sklist {
    // the array of pointers to each element of the list at level x
    struct skiplist ** level_pointer;
    // x goes from 0 to maxlevel-1
    int maxlevel;
    // the compare function
    // this return -1, 0, or 1 if first param is less than, equal, or bigger than
    // the second, respectively
    int (*cmp)(void*, void*);
} Skiplistcontainer;
// a function that create a skiplist
struct sklist * create_skip(int (*cmp)(void*, void*)) {
    struct sklist * slc = (struct sklist *) malloc(sizeof(struct sklist));
    slc->level_pointer = (struct skiplist**) calloc(1, sizeof(struct skiplist*));
    slc->maxlevel = 1;
    slc->level_pointer[0] = NULL;
    slc->cmp = cmp;
    return slc;
}

void logit(const char *restrict format, ...) {
    va_list ap;
    va_start( ap, format );
    vprintf(format, ap);
}

void sklist_insert(struct sklist* slc, void *element) {
    // create the new node
    struct skiplist * sknode = (struct skiplist*) malloc(sizeof(struct skiplist*));
    sknode->element = element;
    sknode->maxlevel = 1;
    // toss a coin to determine the element maxlevel
    while ((rand() % 2) == 1)  {
        sknode->maxlevel++;
    }
    #if LOGLEVEL == 3
    logit("INSERTING %d at LEVE %d\n",*(int*)element, sknode->maxlevel);
    #endif
    sknode->level_pointer = (struct skiplist**) calloc(sknode->maxlevel, sizeof(struct skiplist*));
    int from_level = sknode->maxlevel-1;
    if (sknode->maxlevel > slc->maxlevel ) {
        // if the new element has the tallest level_pointer
        // it means all the pointers with higher level points to the new element
        slc->level_pointer = (struct skiplist**) realloc(slc->level_pointer, sknode->maxlevel * sizeof(struct skiplist*));
        int i;
        for (i = slc->maxlevel; i< sknode->maxlevel; i++) {
            slc->level_pointer[i] = sknode;
            sknode->level_pointer[i] = NULL;
        }
        from_level = slc->maxlevel - 1;
        slc->maxlevel = sknode->maxlevel;
    }
    // starting from_level the insertion must be checked
    struct skiplist ** left_p = slc->level_pointer;
    for(;from_level>=0;from_level--) {
        // peak the next element pointed, still staying a position before
        // keeping in mind that head is smaller than anything,
        // then left_p belong to something smaller than sknode
        while( (left_p[from_level] != NULL) && slc->cmp(left_p[from_level]->element, sknode->element)<=0 ) {
            left_p = left_p[from_level]->level_pointer;
        }
        sknode->level_pointer[from_level] = left_p[from_level];
        left_p[from_level] = sknode;
    #if LOGLEVEL == 3
        logit("Inserted %d\n", *(int*) sknode->element);
    #endif
        //printf("left %d\n", *(int*) left_p[from_level]->level_pointer[from_level]->element);
    }
}

struct skiplist * sklist_exists(struct sklist* slc, void *element) {
    // search for element and return it if it exists, return NULL otherwise
    int maxlevel = slc->maxlevel-1;
    struct skiplist ** lpoint = slc->level_pointer;
    for (;maxlevel>=0; maxlevel--) {
        struct skiplist ** prev;
        while (lpoint[maxlevel]!=NULL && slc->cmp(lpoint[maxlevel]->element, element) <0) {
            printf("Inspecting %d l: %d\n", *(int*) lpoint[maxlevel]->element, maxlevel);
            prev = lpoint;
            lpoint = lpoint[maxlevel]->level_pointer;
        }
        if (lpoint[maxlevel]!=NULL && slc->cmp(lpoint[maxlevel]->element, element) == 0) {
            return lpoint[maxlevel];
        } else {
            lpoint = prev;
        }
    }
    return NULL;
}

struct skiplist * sklist_extract(struct sklist* slc, void *element) {
    // search for element and return it if it exists, return NULL otherwise
    int maxlevel = slc->maxlevel-1;
    struct skiplist ** lpoint = slc->level_pointer;
    struct skiplist * el_pile = NULL;
    while (maxlevel>=0) {
        struct skiplist ** prev = NULL;
        while (lpoint[maxlevel]!=NULL && slc->cmp(lpoint[maxlevel]->element, element) <0) {
            #if LOGLEVEL == 3
            logit("Inspecting %d l: %d\n", *(int*) lpoint[maxlevel]->element, maxlevel);
            #endif
            prev = lpoint;
            lpoint = lpoint[maxlevel]->level_pointer;
        }
        if (lpoint[maxlevel]!=NULL && slc->cmp(lpoint[maxlevel]->element, element) == 0) {
            #if LOGLEVEL == 3
            logit("FOUND HHHHH l:%d\n",lpoint[maxlevel]->maxlevel);
            #endif
            // remove everything from this level here to below:
            if (el_pile == NULL && lpoint[maxlevel]->maxlevel == slc->maxlevel)  {
                el_pile = lpoint[maxlevel];
                // it must resize the maxlevel of the main structure
                // for this just inspect the main level_pointer and this element level_pointer
                // until the second one is NULL and the first one is exactly this element
                // reduce the maxlevel of the mail structure
                int i = el_pile->maxlevel-1;
                while(i>0 && (slc->level_pointer[i] == el_pile && el_pile->level_pointer[i] == NULL)) i--;
                slc->maxlevel = i+1; // the level is the size
                maxlevel = slc->maxlevel;
                #if LOGLEVEL == 3
                logit("shrink level %d\n", maxlevel);
                #endif
            }
            // eat one pos
            lpoint[maxlevel] = lpoint[maxlevel]->level_pointer[maxlevel];
        } else {
            lpoint = prev;
        }
        maxlevel--;
    }
    return el_pile;
    //return NULL;
}

int compare_ints(void *X, void *Y) {
    int *x = (int*) X;
    int *y = (int*) Y;
    if(*x<*y) return -1;
    if (*x == *y) return 0;
    return 1;
}


void print_it(struct sklist* slc) {
    printf("generic staff: maxlevel: %d\n", slc->maxlevel);
    int l = slc->maxlevel;
    for(int i=0;i<l;i++) {
        struct skiplist * head = slc->level_pointer[i];
        printf("\nLEVEL: %d\n",i);
        while (head != NULL) {
            printf("%d\t-\t", *(int*) (head->element));
            head = head->level_pointer[i];
        }
    }
    printf("\n");
}

void pile_print_it(struct sklist* slc) {
    printf("PILE staff: maxlevel: %d\n", slc->maxlevel);
    int l = slc->maxlevel;
    for(int i=0;i<l;i++) {
        printf("\nLEVEL: %d\n",i);
        struct skiplist * head = slc->level_pointer[i];
        struct skiplist * head0 = slc->level_pointer[0];
        while (head != NULL) {
            while (head0!= head) {
                printf("--\t-\t");
                head0 = head0->level_pointer[0];
            }
            printf("%d\t-\t", *(int*) (head->element));
            head = head->level_pointer[i];
            head0 = head0->level_pointer[0];
        }
    }
    printf("\n");
}

int main() {
    int *i;
    *i = 190;
    int j = 12;
    printf("COMPARE %d vs %d : %d\n", j, *i, compare_ints((void*) &j, (void *) i));
    // *j = 12;
    struct sklist *skipl = create_skip(compare_ints);
    print_it(skipl);
    sklist_insert(skipl, (void*)i);
    print_it(skipl);
    sklist_insert(skipl, (void*)&j);
    print_it(skipl);
    int k = 23;
    sklist_insert(skipl, (void*)&k);
    print_it(skipl);
    int kk = 123;
    sklist_insert(skipl, (void*)&kk);
    pile_print_it(skipl);
    int kk2 = 23;
    struct skiplist *el = sklist_exists(skipl, (void*) &kk2);
    if(el!=NULL) {
        printf("FOUND!!!!!\n");
    } else {
        printf("NOOOOT FOUND!!\n");
    }
    for(;;) {
        printf("command (I_nsert/L_ookup): \n");
        char command = (char) getchar();
        //if (command == '\n') command = (char) getchar();
        switch (command) {
            case 'i':
            case 'I':
            {
                printf("insert a num: ");
                int *xx = malloc(sizeof(int));
                scanf("%d", xx);
                sklist_insert(skipl, (void*)xx);
                pile_print_it(skipl);
            }
            break;
            case 'l':
            case 'L':
            {
                printf("lookup a num: ");
                int *xx = malloc(sizeof(int));
                scanf("%d", xx);
                struct skiplist *el = sklist_exists(skipl, (void*) xx);
                if(el!=NULL) {
                    printf("%d FOUND!!!!!\n", *xx);
                } else {
                    printf("%d NOOOOT FOUND!!\n", *xx);
                }
            }
            break;
            case 'e':
            case 'E':
            {
                printf("extract a num: ");
                int *xx = malloc(sizeof(int));
                scanf("%d", xx);
                struct skiplist *el = sklist_extract(skipl, (void*) xx);
                if(el!=NULL) {
                    printf("%d FOUND!!!!!\n", *xx);
                } else {
                    printf("%d NOOOOT FOUND!!\n", *xx);
                }
                //free(el);
            }
            case 'p':
            case 'P':
                pile_print_it(skipl);
                break;
            case 'x':
                return 0;
        }
    }
}

there is some bugs in there, to be fixed

Implementing Authorization Workflow (on Amazon SP API)

Daniele Cruciani — Wed, 11 Sep 2024 03:01:01 +0000

Amazon Selling Partner API documents two kinds of authorization workflow, one starting from your website app https://developer-docs.amazon.com/sp-api/docs/website-authorization-workflow, and the other one starting from the Amazon App store.

Authorize from your website

While implementing the authorize workflow from your website, you start assuming that the user is already logged in. This means the browser is keeping a set of cookies associated with your domain, one of those being the session_id (however your framework is naming it does not really matter).

So, the main assumption is that, wherever the user goes after visiting your page, when he or she comes back to your website the session cookie allow your website to identify the user_id (or however your system names the user identifier).

Now, following direction and steps described in https://developer-docs.amazon.com/sp-api/docs/website-authorization-workflow, whenever the workflow lay on your website, in addition to state and auth_code, the session_id is another implicit information you have to match the request.

So, why on earth you need to send a state field during the step 2? Well, your system does not know how many browser are connected to the same account, maybe from the same real user, but just not active.

That means your application must take track and awareness about the authorization process, and from which session_id it where started.

REST is stateless

Most of the application are implemented using a REST API and a frontend framework, in my example there is gateway verifying a JWT, a backend microservice handling the request, and a ReactJs frontend making REST calls.

Semplified Sequence diagram
This diagram is semplified, microservice run in a Cloud environment, and has access to database, redis, and whatever service is required.

When user start an Amazon authorization process the React App call a specific API, how does is it associatated with the specific instance of the React App?

This is done by:

generating an UUID (see https://www.npmjs.com/package/uuid)
storing that UUID as a cookie with lifetime of 10 minutes
using a POST /auth-gen request with that uuid (I call it cookie_uuid). The API reply with an authorization url, as described in step 2.

In the backend:

POST /auth-gen call: the state is generated by uuid() and stored in a redis server with the key userid-[state] and value of received cookie_uuid
POST /auth-verify call: with the payload of state, selling_partner_id, mws_auth_token (it is void, afaik), spapi_oauth_code, cookie_uuid, it verify the key userid-[state] exists in the redis and it contains the sent value cookie_uuid, then proceed with LWA staff acquiring the refresh_token, and storing it somewhere
POST /auth-assign-account call: this call assign the specified acquired (and pending) refresh_token, to internal structure associated with the customer. This is just in case your system support more external selling platforms REST is stateless, but redis implement what is needed, also the browser cookie is keeping track of the process

Looking at the sequenceDiagram above, on the two extreme, both Microservice and ReactApp have access to some support to keep the state persistent, even if the service or the ReactApp is switched off: a stateless microservice has redis and db, ReactApp has browser cookie and/or browser localstorage

The React Application: how to recognize the time to verify app
The only way for the frontend app to recognize the page was opened after a redirect from amazon (with granted authorization) is by parsing the get parameters. Assuming we are using React+Redux, and also hook and effect, somewhere in the main App there should be something like:

const params = getQueryParams(location);
const dispatch = useDispatch();
  useEffect(() => {
    if (
      params.get("state") &&
      params.get("selling_partner_id") &&
      params.get("spapi_oauth_code")
    ) {
      let payload = {
        state: params.get("state"),
        selling_partner_id: params.get("selling_partner_id"),
        spapi_oauth_code: params.get("spapi_oauth_code"),
        mws_auth_token: params.get("mws_auth_token"),
      };
      dispatch({
        type: AuthorizeAmazon.AUTHORIZE_CONFIRM_FROM_AMAZON,
        payload,
      });
    } else {
      console.log("NOT DISPATCH");
    }

Where const getQueryParams(location) is something like:

const getQueryParams = (s?: string): Map<string, string> => {
  if (!s || typeof s !== "string" || s.length < 2) {
    return new Map();
  }

  const a: [string, string][] = s
    .substr(1) // remove `?`
    .split("&") // split by `&`
    .map((x) => {
      const a = x.split("=");
      return [a[0], a[1]];
    }); // split by `=`
  return new Map(a);
};

The in redux action for AuthorizeAmazon.AUTHORIZE_CONFIRM_FROM_AMAZON there is code for retrieving cookie data and POST /auth-verify

Frontend / Backend decoupling

With this implementation the backend maintain the knowledge of the application_id, and also for the generation of authorization url, whose are returned by the API call and used by React App to redirect to amazon, or whatever.

Still, there is logic that are well bound between frontend and backend: the cookie_uuid.

In fact cookie_uuid and redis storage implement a kind of state bound between user browser and backend

This is ok since there is a expiration time associated with that, on both side

From App Store Authorization Workflow

I had no direct experience on implementing the authorization workflow from the the App Store, it would be more complex if the customer has no account on our website, in this case in fact a quick registration process must be implemented: the process can take no more than 10 minutes. This constraint can be really critical, since amazon is not providing any customer information via its API, neither their email, just the merchant_id. So your system must be elastic enough to accept different kind of identifiers. Another option is to assign a temporary email address, then give the customer the option to change this temporary email address with its real email address. You can also force your customer to specify and verify a real email address, in order to try/activate your service.

The workflow is described in https://developer-docs.amazon.com/sp-api/docs/selling-partner-appstore-authorization-workflow