Re: Securing ssh tunnels.

From: Brian Hatch (secure-shell_at_ifokr.org)
Date: 06/27/03

  • Next message: Roy S. Rapoport: "Re: Second instance if SSH not running" 
    Date: Fri, 27 Jun 2003 11:42:19 -0700
To: Markus Friedl <markus@openbsd.org>

    > but even if you have a ssh mitm-proxy, you still can do this:
    >
    > ssh \
    > -o proxycommand="ssh -p %p %h sshd -i -h $HOME/.ssh/hostkey -f /dev/null" \
    ...

    Of course. However you've prevented the easiest method. Such a proxy
    will still stop

            * a non-savvy employee or cracker who wants to tunnel
            * an uneducated employee who's .ssh/config has permissive modes
                    (X11, agent) and doesn't need them or know about it

    And, since you do have access to the outer SSH transmission in
    cleartext, you would be able to see if they're tunneling something
    inside it and use the correct means to correct the problem: fire
    the employee. 

    --
Brian Hatch                  Cat.  The other white meat.
   Systems and
   Security Engineer
http://www.ifokr.org/bri/
Every message PGP signed

  • Next message: Roy S. Rapoport: "Re: Second instance if SSH not running"

    Relevant Pages

    • Putty Proxy Chaining
      ... I have a project requiring the set-up of an proxied ssh session using ... I have successfully achieved this where there is a single proxy ... What I'd appreciate is if I could be told how to configure PuTTY to use ... We want to provide SSH access to a remote server ...
      (comp.security.ssh)
    • Re: configuring SSH to act as a vpn tunnel
      ... > tunnel I establish and connect to the proxy on that remote box (that I ... I guess the general question is: Can I use ssh as a generic vpn?? ... set up tunnels for a few ports. ...
      (comp.os.linux.networking)
    • Re: configuring SSH to act as a vpn tunnel
      ... > tunnel I establish and connect to the proxy on that remote box (that I ... I guess the general question is: Can I use ssh as a generic vpn?? ... set up tunnels for a few ports. ...
      (comp.os.linux.security)
    • RE: ssh webclient
      ... I binded my sshd on port 443, and set up putty to connect on 443. ... I think we have a transparent proxy or something like that. ... > outside ssh server to port 443, or set up a ssh server at home to port ... I do not get the timeout when i do this if there is not ...
      (SSH)
    • RE: ssh tunneling to bypass web proxy rules
      ... you can use a SSH server as a socks proxy for whatever ... Using group policy to forbid proxy changes via Internet Explorer, ... person who knows what he's doing, restrict more than most admins want ...
      (Security-Basics)