Pass an Established HTTP CONNECT Tunnel to Paramiko

Connect Paramiko through an authorized HTTP CONNECT route while retaining SSH host-key verification.

Once an HTTP CONNECT helper has returned a tunnel to the intended SSH server, give that stream to Paramiko:

with paramiko.SSHClient() as client:
    client.load_system_host_keys()
    client.connect('ssh.example.com',
                   username='operator',
                   sock=tunnel,
                   banner_timeout=10,
                   auth_timeout=10)
    # Use the verified SSH connection.

Replace the example host and load the deployment's correct known-hosts data. tunnel must already lead to that same server. The hostname passed to connect identifies the SSH host key, not the proxy.

The sock interface accepts an open socket or socket-like object. It does not negotiate HTTP for you. Before returning it, the connector must:

  1. Connect to the proxy and send a valid destination CONNECT request.
  2. Complete any supported proxy authentication and validate a successful tunnel status.
  3. Read the entire proxy header section, handling partial reads and preserving bytes beyond the boundary.
  4. Bound setup and close rejected/error sockets through its cleanup path.

Use a maintained connector for that work. Searching one receive buffer for an English success phrase misses split status lines, variable reason text and incomplete headers. A successful proxy TCP connection is not the accepted SSH tunnel.

The proxy must permit the requested SSH port; web browsing permission does not establish CONNECT to port 22 access. A 407 occurs before SSH login, while an SSH account failure occurs after the tunnel. Keep those accounts separate.

Close the SSH client and connector-owned resources when finished. A task stopping its reads does not itself close a live connection.

متعلقہ مضامین