-
Notifications
You must be signed in to change notification settings - Fork 2
/
ssh-over-xray.html
219 lines (210 loc) · 7.73 KB
/
ssh-over-xray.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>SSH over Xray</title>
<link rel="stylesheet" href="css/style.css">
<meta property="og:title" content="SSH over Xray">
<meta property="og:description" content="When you want to SSH into a remote server, but your direct connection to the remote server is blocked">
<meta property="og:type" content="website">
<meta property="og:image" content="https://computerscot.github.io/img/computerscot.png">
<meta property="og:url" content="https://computerscot.github.io/ssh-over-xray.html">
</head>
<body>
<div id="bar">
<div class="wrapper">
<p><a href="https://computerscot.github.io">computerscot.github.io</a></p>
</div>
</div>
<div class="wrapper">
<h1>SSH over Xray</h1>
<p><em>July 18, 2023</em></p>
<p>The scenario in this post is that you want to SSH into a remote server, but your direct connection to the remote server is blocked by a firewall. Therefore you decide to pass SSH over an Xray connection. There are two server IP addresses in the examples:</p>
<blockquote><code>XRAY.SERVER.IP.ADDRESS</code></blockquote>
<blockquote><code>SSH.SERVER.IP.ADDRESS</code></blockquote>
<h2>Xray server</h2>
<p>Install Xray-core on your Xray server using the latest beta, and configure it to run as root:</p>
<blockquote><code>bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install --beta -u root</code></blockquote>
<p>Example of a completed server configuration file <code>/usr/local/etc/xray/config.json</code>:</p>
<pre>
{
"log": {
"loglevel": "warning"
},
"routing": {
"domainStrategy": "IPIfNonMatch",
"rules": [
{
"type": "field",
"ip": [
"geoip:cn",
"geoip:private"
],
"outboundTag": "block"
}
]
},
"inbounds": [
{
"listen": "0.0.0.0",
"port": 443,
"protocol": "vless",
"settings": {
"clients": [
{
"id": "3b5390c5-52a2-472d-8dc2-103ef508be6c",
"flow": ""
}
],
"decryption": "none"
},
"streamSettings": {
"network": "h2",
"security": "reality",
"realitySettings": {
"show": false,
"dest": "www.lovelive-anime.jp:443",
"xver": 0,
"serverNames": [
"www.lovelive-anime.jp"
],
"privateKey": "QNraK6EdxPNOzfbL2G1BTl_OeMSxm49H5vps2qzQ3E0",
"shortIds": [
"77c2358dc476ae9e"
]
}
}
}
],
"outbounds": [
{
"protocol": "freedom",
"tag": "direct"
},
{
"protocol": "blackhole",
"tag": "block"
}
]
}
</pre>
<p>Restart <code>xray</code> systemd service with your final configuration file:</p>
<blockquote><code>systemctl restart xray</code></blockquote>
<blockquote><code>systemctl status xray</code></blockquote>
<h2>Xray client</h2>
<p>Download the Xray CLI client from <a href="https://github.com/XTLS/Xray-core/releases">https://github.com/XTLS/Xray-core/releases</a>.</p>
<p>Create a file <code>config.json</code> in the same folder as the <code>xray</code> executable. Following is a template you can use for your client configuration <code>config.json</code>. Note that the Xray client will accept SOCKS proxy input on port <code>10808</code>.</p>
<pre>{
"log": {
"loglevel": "warning"
},
"routing": {
"domainStrategy": "IPIfNonMatch",
"rules": [
{
"type": "field",
"domain": [
"geosite:category-ads-all"
],
"outboundTag": "block"
},
{
"type": "field",
"domain": [
"geosite:geolocation-!cn"
],
"outboundTag": "proxy"
},
{
"type": "field",
"domain": [
"geosite:cn",
"geosite:private"
],
"outboundTag": "direct"
},
{
"type": "field",
"ip": [
"geoip:cn",
"geoip:private"
],
"outboundTag": "direct"
}
]
},
"inbounds": [
{
"listen": "127.0.0.1",
"port": 10808,
"protocol": "socks"
},
{
"listen": "127.0.0.1",
"port": 10809,
"protocol": "http"
}
],
"outbounds": [
{
"protocol": "vless",
"settings": {
"vnext": [
{
"address": "XRAY.SERVER.IP.ADDRESS",
"port": 443,
"users": [
{
"id": "3b5390c5-52a2-472d-8dc2-103ef508be6c",
"encryption": "none",
"flow": ""
}
]
}
]
},
"streamSettings": {
"network": "h2",
"security": "reality",
"realitySettings": {
"show": false,
"fingerprint": "chrome",
"serverName": "www.lovelive-anime.jp",
"publicKey": "eZfl07Tg9UII29GaS23QXqB15aqrJ4Khm0vKJIcaMCo",
"shortId": "77c2358dc476ae9e",
"spiderX": ""
}
},
"tag": "proxy"
},
{
"protocol": "freedom",
"tag": "direct"
}
]
}</pre>
<p>At a minimum, replace <code>XRAY.SERVER.IP.ADDRESS</code> with the actual Xray server IP address.</p>
<p>Save the file with your changes in it.</p>
<p>Set the CLI client running with the above <code>config.json</code>:</p>
<blockquote><code>./xray -c config.json</code></blockquote>
<p>Leave the terminal window open with the <code>xray</code> program running in it.</p>
<h2>SSH server</h2>
<p>The only special preparation you need on the SSH server is to open the firewall for SSH input on port <code>tcp/22</code> from source IP address <code>XRAY.SERVER.IP.ADDRESS</code>.</p>
<h2>SSH client</h2>
<p>Your workstation will be the SSH client, communicating with the SSH server, but doing so over the Xray connection between your workstation and your Xray server.</p>
<p>Open a second terminal window, so that the Xray client can continue to run in the first terminal window.<p>
<p>Edit <code>.ssh/config</code>. Insert the following lines:</p>
<pre>Host myssh
Hostname SSH.SERVER.IP.ADDRESS
User ubuntu
ProxyCommand nc -X 5 -x 127.0.0.1:10808 %h %p
ServerAliveInterval 10</pre>
<p>Replace the hostname and user as necessary.</p>
<p>Save the file with your changes in it.</p>
<p>Then to connect use:</p>
<blockquote><code>ssh myssh</code></blockquote>
</div>
<!-- Cloudflare Web Analytics --><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token": "94e45ea74d58413395c468ebe6bab324"}'></script><!-- End Cloudflare Web Analytics -->
</body>
</html>