Hacker News Reader

Comment by mikorym | Hacker News Reader

What do you mean by that?

Corporate MITM devices, like those from Forcepoint. Or domain managed client side content filtering / endpoint protection. Basically overzealous IT security stuff. Most won't be fooled by simple stuff like just running sshd on port 443.

Edit: Though these MITM vendors will soon have fun with DNS over https and encrypted SNI. Guess they will have to resort to being browser plugins?

As an an example, at my work you cannot make any outbound ssh connection. The only way to get one is to apply for a specific connection , where you have to explain why you need an outbound connection, in which case they open a port for you and the remote machine you specified.

Using tools like this to get around that restriction is quite possibly the worst idea I've seen today.

corkscrew?

if it's just filtering of certain ports, you can just set your ssh port to 80 or 443

Yep, using 443 as your SSH port seems a good way of doing this. I do.

In its simplest form, yes.

Anything more sophisticated will inspect the traffic and drop SSH connections no matter the port.

At my last job we used corkscrew (https://github.com/bryanpkc/corkscrew) to tunnel ssh through HTTP proxies without needing the ssh server to use another port.

I guess if that work depends on how the proxy is set up.

I suggest learning how those filters work. Also please do respect the policies, they're usually there to protect the intellectual property and you might be unwittingly putting yourself in spotlight despite having no bad intentions.

Oh yeah I wasn't going to try and circumvent, just giving an example to elucidate

Wouldn't you have to apply for permission for the article's solution for the exact same reason?

If not, then this seems like an exfiltration risk your security people should fix.

What happens when you log into a VPN and then SSH elsewhere; that should work, right?

Reply on news.ycombinator.com