Let rsync Reuse an SSH Host Alias Through the HTTP Proxy

Attach an HTTP CONNECT helper to the SSH configuration used by rsync’s remote-shell transport.

For rsync’s SSH transport, put the forward-proxy connection on the SSH host alias. With the OpenBSD implementation of nc, an unauthenticated HTTP proxy can be selected in ~/.ssh/config:

Host sync-target
    HostName files.example.net
    User syncuser
    Port 22
    ProxyCommand nc -X connect -x proxy.example.net:8080 %h %p

The proxy must permit CONNECT to files.example.net:22. For a public SSH host where public intermediaries are permitted, the HTTP proxy list offers candidates for the no-account proxy host and port; verify permission for the actual SSH target and port. nc’s -x address identifies the intermediary; %h and %p expand to the SSH destination and port. A different program also named nc may not support these switches.

Use the alias as the remote host in rsync:

rsync -av -e ssh sync-target:/srv/export/ ./export/

The single-colon path selects the remote-shell form. SSH uses its normal target account and host-key configuration, while the helper carries its byte stream through the HTTP proxy. The destination also needs rsync available for the remote command.

RSYNC_PROXY instead configures rsync’s direct daemon connection. It does not configure this SSH invocation. Likewise, changing the SSH Port to 8080 would select another destination service port, rather than identify the proxy listener.

Keep proxy authentication on the chosen helper’s supported interface when required; an SSH username is not a proxy username.

Mikanda mikatakata