Here is another solution, for a slightly different use case, namely:
- You can access
github.com from a host, say, foo.
- You actually need to connect to it from a different host, say
bar.
- You only need to do this interactively - never from cron jobs or some other automated action.
- However,
bar is not allowed to make any outgoing TCP connections - either directly or via a proxy host.
- You can use SSH to connect from
foo to bar.
- On this connection, you are allowed to set up a reverse SSH tunnel.
In this situation, you can do the following:
- On
foo, in ~/.ssh/config, specify a reverse SSH tunnel for host bar.
- On
bar, in ~/.ssh/config, specify the tunnel endpoint as a proxy for host github.com.
For example, with reasonably modern versions of OpenSSH, you can use:
Host bar
RemoteForward 22022 bar:22
on foo, and on bar:
Host github.com
ProxyJump localhost:22022
Now, if all is well, after doing
slogin bar
on foo, you can use, on bar:
git clone [email protected]:github/gitignore.git
(or whatever repository you wish to use) and this will attempt to use the reverse tunnel from localhost:22022 to foo to connect to github.com.
This works for me (with both hosts running Ubuntu 18.04).
Notes:
- It should be possible to replace the
~/.ssh/config lines on bar with something equivalent in ~/.gitconfig; e.g., using gitProxy or [url (...) .insteadOf (...)]. I haven't managed to make this work.
- To connect to
github.com using HTTPS instead of SSH, reverse tunnel to port 443 instead of 22.
- This is pretty brittle, as it relies on special bits of configuration on
foo and bar working in tandem. So I wouldn't recommend this, except for the given use case, for which it is hard to think of anything better.
ProxyJump. At the client side configure ssh to use the server as a jump-host for GitHub.