Hacker News Reader

Dumb question, but couldn't you just tell the OpenSSH server to use port 80 or port 443 or something and just connect like `ssh me@host -p 80`?

View on HN

Yes, that's likely to work on many firewalls, but:

- it means you can't also serve HTTP on those ports (so you'd need a dedicated IP address for SSH), and

- as @charcircuit wrote, it won't resist deep packet inspection.

(But if DPI is a problem and you have a spare IP address, you could just use SSH over TLS without needing the HTTP CONNECT stuff and Apache.)

That just changes the port it uses. It wouldn't change the protocol.

Fair, I guess I was not sure if it was just blocking the port, or doing something to directly block the protocols as well.

The author values having a robust solution since he mentions the DPI resistance near the end of the article. If he was going to mask ssh as https, he might as well do it properly.

Reply on news.ycombinator.com