Running web ssh client on port 443 /80 with nginx as reverse proxy

Package used         : shellinabox , nginx
Repository used        : epel-release
Linux distro used    : Centos 7.6

nginx reverse proxy server ip : 192.168.1.65
shellinabox web ssh server ip : 192.168.1.111

login to web ssh server first

install epel-repo
# yum install epel-release -y

install shellinabox package

# yum -y install shellinabox

start and enable shellinaboxd service

# systemctl enable shellinaboxd && systemctl start shellinaboxd

By default shellinaboxd service starts with ssl port 4200
for us to run this in a reverse proxy environment need to make this as insecure hence the encryption will be done by nginx to end user.

edit file /etc/sysconfig/shellinabox  like bellow-

USER=shellinabox
GROUP=shellinabox
CERTDIR=/var/lib/shellinabox
PORT=4200
OPTS="--disable-ssl-menu -s /:LOGIN"
OPTS="-t -s /:SSH:192.168.1.111"

save file exit and restart service

# systemctl restart shellinaboxd
Now open firewall for listening port 4200 from nginx proxy server only

# firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.65/32" port protocol="tcp" port="4200" accept'
# firewall-cmd --reload


Now login to nginx proxy server
Install nginx service

# yum install nginx -y

create a file /etc/nginx/conf.d/webshell.conf

# vim /etc/nginx/conf.d/webshell.conf

paste content as bellow

server {
    listen         443 ssl http2;
    server_name    webshell.mylab.local;
    ssl_certificate /etc/ssl/certs/webshell.crt;
    ssl_certificate_key  /etc/ssl/private/webshell.key;

    location / {
        proxy_pass http://192.168.1.111:4200;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

save file and exit
now check syntax error

# nginx -t

restart service

# systemctl restart nginx

open browser and open url https://webshell.mylab.local

Note i am using own certificate and key here with ngixn which is internally signed. It is recommended to use a valid certificate with letsencrypt.