[fw-wiz] Firewal with SSH inspection? (was Re: Firewall bake-off?)



On 3/19/07, Jim MacLeod <jmacleod@xxxxxxxxx> wrote:
Similarly, a layer 7 proxy does not provide any more security than a
layer 4 stateful packet filter - for a given protocol - if the layer 7
element does not enforce rules for that protocol.

Aside from some grumblings about fragment reassembly, you won't find
any arguments against that statement here.

My favorite example
is ssh: port forwarding allows a lot of sins to be hidden from
centralized access control, but "it's encrypted, so it must be
secure." (Yes, there are ssh proxies that can address this, but
they're not a common feature in firewalls.)

Are there ssh proxies that can address this?

I know smart MITM proxies exist for SSL/TLS, but didn't realize there
are transparent SSH proxies which can permit SSH logins and SCP/SFTP,
but block (or better yet, control) port forwarding?

I've been looking for this for a couple of years, but all I hear from
vendors is "someday, soon".

Currently I have a vendor who *insists* they need to tunnel outbound
SSH from a production "appliance" over TCP/443 to an Internet host in
the middle east, and doesn't understand why we can't change the policy
to permit this "VPN".

Actually, at first they didn't understand why the connections were
failing, saying "But it 'just works' everywhere else we have this
model server installed".


Thanks,

Kevin "I've got a project and a budget if you have a product" Kadow
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards



Relevant Pages

  • Re: [fw-wiz] Firewal with SSH inspection? (was Re: Firewall bake-off?)
    ... proxy for interactive sessions first and think on scp later maybe.. ... is ssh: port forwarding allows a lot of sins to be hidden from ... Are there ssh proxies that can address this? ...
    (Firewall-Wizards)
  • Re: [fw-wiz] Firewal with SSH inspection? (was Re: Firewall bake-off?)
    ... > is ssh: port forwarding allows a lot of sins to be hidden from ... Are there ssh proxies that can address this? ... They even market an appliance called "shell control box", ...
    (Firewall-Wizards)
  • Re: Port Forwarding over Unreliable Connections
    ... >I make extensive use of ssh port forwarding to access machines behind ... >patiently wait a long time before finally snipping the connection. ... two separate TCP connections when you do port forwarding, ...
    (comp.security.ssh)
  • Re: Free Port forwarding and tunnelling software for Linux
    ... ssh -D will handle dynamic port forwarding and tunneling ... to its intended recipient, you are hereby notified that any dissemination, ... distribution or copying of this communication is strictly prohibited. ...
    (RedHat)
  • SSH Tunneling and TCP_NODELAY
    ... I am using SSH port forwarding on a linux sshd from the Cygwin ssh. ... tunneling, as I have been using many port forwards (server ... If port forwarding is NOT used, the control stream is working well. ...
    (comp.security.ssh)