Re: Securing ssh tunnels.

From: Bill Weiss (houdini_at_nmt.edu)
Date: 06/27/03

  • Next message: Michael Martinez: "Regarding the sftp logging patch: complaints, criticism, praise, etc." 
    Date: Fri, 27 Jun 2003 09:51:07 -0600
To: secureshell@securityfocus.com

    Roy S. Rapoport(rsr@inorganic.org)@Thu, Jun 26, 2003 at 06:17:01PM -0700:
    > When dealing with a cleartext protocol (HTTP, telnet), your filters/proxies
    > can exercise perfect control over what's going out, because they can
    > inspect the payload. Your outbound connection has "ORCL" and "MSFT" in the
    > payload? Well, maybe it'll have a little accident on the way ...
    >
    > But with SSH/HTTPS, you're screwed -- there's no way to figure out what
    > the user is sending out. It is, from your point of view, less secure, much
    > like the government feels it's less secure for everybody to have cyphers
    > the NSA can't crack.

    That's where sshmitm and webmitm come in. You tell all of your users
    that, yeah, SSH/SSL is a great idea. But you have an obligation to see
    all outgoing traffic. They still get their stuff encrypted from point to
    point (with a small crack inbetween), you get to make sure they're not
    doing anything stupid. Same as you do with web traffic (transparent
    proxy) and telnet. 

    -- 
Bill Weiss
 
The right of the people to be secure in their persons, houses, papers, and
effects, against unreasonable searches and seizures, shall not be
violated, and no Warrants shall issue, but upon probable cause, supported
by oath or affirmation, and particularly describing the place to be
searched, and the persons or things to be seized.
	--	The fourth amendment
  • Next message: Michael Martinez: "Regarding the sftp logging patch: complaints, criticism, praise, etc."

    Relevant Pages

    • Re: vpn on FC1
      ... Forget telnet, it's superceded by SSH. ... >>We need secure remote access to a few TCP servers running ... > And just use POP3S and IMAPS instead of the normal daemons without ...
      (Fedora)
    • Re: Can access secure site from dial-up but not from LAN network
      ... Telnet to amazon.com works as you describe, however the telnet to the secure ... web site gets a connect failed message. ... From the same computer, I dial-up ...
      (microsoft.public.security)
    • Re: Win2000 Pro TelnetServer
      ... I believe you can run MMC and add the Security Templates snapin to control ... People wanting a secure remote admininstration tool probably shouldn't use ... Telnet as everything is passed unencrypted, ...
      (microsoft.public.win2000.security)
    • Re: Securing telnet
      ... which we must secure a linux machine as well as attempt to hack others. ... We must offer telnet as a service, and there is a TA who will ... How about running telnet on a port other than the standard one? ...
      (comp.os.linux.security)
    • Re: Securing ssh tunnels.
      ... >> network data between the two systems and unlike plain text protocols ... and only allow very limited outbound connections. ... When dealing with a cleartext protocol (HTTP, telnet), your filters/proxies ... It is, from your point of view, less secure, much ...
      (SSH)