Hacker News Reader

Comment by mr_toad | Hacker News Reader

It’d be nice if you could just outbound ssh from anywhere that has a browser, but sadly this isn’t the case.

You would have to really trust whatever service is providing this ssh client. For a browser based ssh client either it's code running on your local computer (in which case, just download an ssh client) or your ssh connection is coming from some third party server that you may or may not trust.

This is something I've thought about time and again, but the security issues always seem to outweigh any potential benefit from something like the OP or similar (in my opinion).

With the help of an additional “proxy”, you can. One such proxy software is Apache Guacamole. It doesn’t only do remote desktop, it also does SSH.

It can also be subject to MITM. If you don't control the certificate store on your device then you don't control the connection to Guacamole (or anywhere else via HTTPS).

Basically any attacker that is able to control the certificate store on your device could also just install a keylogger.

What do you mean by that?

As an an example, at my work you cannot make any outbound ssh connection. The only way to get one is to apply for a specific connection , where you have to explain why you need an outbound connection, in which case they open a port for you and the remote machine you specified.

Using tools like this to get around that restriction is quite possibly the worst idea I've seen today.

corkscrew?

if it's just filtering of certain ports, you can just set your ssh port to 80 or 443

Yep, using 443 as your SSH port seems a good way of doing this. I do.

In its simplest form, yes.

Anything more sophisticated will inspect the traffic and drop SSH connections no matter the port.

At my last job we used corkscrew (https://github.com/bryanpkc/corkscrew) to tunnel ssh through HTTP proxies without needing the ssh server to use another port.

I guess if that work depends on how the proxy is set up.

I suggest learning how those filters work. Also please do respect the policies, they're usually there to protect the intellectual property and you might be unwittingly putting yourself in spotlight despite having no bad intentions.

Oh yeah I wasn't going to try and circumvent, just giving an example to elucidate

Wouldn't you have to apply for permission for the article's solution for the exact same reason?

If not, then this seems like an exfiltration risk your security people should fix.

What happens when you log into a VPN and then SSH elsewhere; that should work, right?

Corporate MITM devices, like those from Forcepoint. Or domain managed client side content filtering / endpoint protection. Basically overzealous IT security stuff. Most won't be fooled by simple stuff like just running sshd on port 443.

Edit: Though these MITM vendors will soon have fun with DNS over https and encrypted SNI. Guess they will have to resort to being browser plugins?

Reply on news.ycombinator.com