Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My school currently blocks outbound SSH traffic. Users inside the network cannot use Port 22, and attempting to make an SSH connection over another port is also blocked. (I'm assuming the firewall drops any packets that seem to use the SSH protocol.)

The excuse given for this is that allowing outbound SSH traffic would put users inside the network at risk, and that it would allow "port forwarding". (Their words not mine) Translated, I think the administrators are worried that a virus on a user's computer might try to use SSH to contact Command and Control servers. I think they also want to keep the port closed because it could be used for proxy connections, TOR, and the like.

To my knowledge, most of the present-day "active" viruses aren't using SSH for C&C. Also, a proxy could be established over any port, could it not? Such as 80, which is of course already open for regular internet browsing?

I understand that there are implications of inbound SSH connections, but I don't see how not allowing students to make outbound connections really improves security all that much. For one, it prevents me from using Github and Heroku, which I need for my outside job.

Could someone please respond with either more, better reasons why outbound SSH should be blocked or (preferably) with reasons why this network policy is irrational?

share|improve this question
add comment

7 Answers

I think they also want to keep the port closed because it could be used for proxy connections, TOR, and the like.

Yes, that's the most likely explanation.

It is possible that malware would go outbound using SSH to hide it's traffic. It's also possible that malware, or users, could use SSH remote port forwarding to permit "inbound" connections that are blocked by the firewall. These are valid but probably lesser concerns for your school.

Their primary issue with SSH is probably not that it allows these tunnels, which as you point out could go over other ports and other protocols, but that it hides them beneath encryption, and blocks the ability of the administrator to control what the network is used for. While other tools can do this too, SSH is "out of the box" and represents low hanging fruit for them to block.

Could someone please respond with either more, better reasons why outbound SSH should be blocked or (preferably) with reasons why this network policy is irrational?

Their technical reasons are valid but possibly a little specious for (a school's) level of security requirements. The administrative reasons are valid to them, but irrational to you. Unfortunately for you, it's their network.

Where I expect you'll be tunneling SSH-over-SSL sometime soon.

share|improve this answer
2  
+1 for the SSH-over-SSL suggestion. I never knew. –  Safado Aug 18 '11 at 17:03
7  
I agree. When a system administrator is given responsibility for security without any counterbalancing responsibility for user satisfaction, the administrator will go for those solutions that provide security at the expense of usability. The administrator will also seek solutions that are easy to implement and maintain. In this case where the students have no input, the most restrictive and inflexible solutions will be implemented. –  this.josh Aug 19 '11 at 7:43
7  
@this.josh, and that brings up "AviD's Correlative Theory of Usability: Security at the expense of usability, comes at the expense of security.". –  AviD Sep 5 '11 at 8:13
add comment

I'd say that 90%+ of the time you encounter an argument like that in regards to tunneling, especially in a school, the goal is to prevent you form tunneling out. If you can tunnel, then you can bypass their webfilter. If you can, somebody else will. Then after enough folks catch on, some twit will watch porn in the library, get in trouble, and somebody will be asking the sysadmin how the hell that could happen.

share|improve this answer
    
What's to stop students from setting up a mirrorrr on Google App Engine? That goes over port 80 or 443, normal Web ports (HTTP & HTTPS). It works for the dumb Internet filter at the public library that often blocks programming websites and tools for bogus reasons. –  dgw Sep 6 '11 at 1:53
1  
@Voyagerfan5761: No technical reason that won't work -- just explaining the likely logic of the administration and noting that it probably isn't really about security. –  Jeff Ferland Sep 6 '11 at 2:03
1  
Heh, my goal was to demonstrate that no matter what ports you block, unless you're killing all Web traffic, you've got a hole. Unless you start hunting down personal mirrorrrs (or other proxies) and blocking them by domain/IP, or just blocking all of Google App Engine. (Actually, aforementioned public library's filter used to block all of blogspot.com.) –  dgw Sep 6 '11 at 2:22
add comment

In a school environment where the pipes are large it's best to lock things down. If not people (students, faculty and others) will install p2p software, illegal software and do other things that can raise the liability for the school, cost people their jobs to fuel personal interests without taking into account how it would affect the enterprise.

There are also the need to prevent access to unsafe websites, malware detection, etc. as much as possible in an enterprise school network. As one mess-up by one student could potentially affect all others, especially if computers are on a domain. The system and network administrators main priorities are to keep things available, secure, non congested, safe and to meet the needs of Senior Management (deans, vps, presidents, etc.).

Normally it's safer to do a whitelist instead of a blacklist in terms of security, but it can also be frustrating to those wanting to have fun or do legitimate research. There should be a formal request process procedure to request access to certain sites and having certain protocols opened with justification (professor needs it from 9am to 2pm, or wants to do a live demonstration of something of that nature).

There will always have to be work to maintain a balance between security and useability with security coming before usability if something is known to be unsafe like allowing ftp and other non secure protocols for authentication.

share|improve this answer
    
Aren't whitelists safer than blacklists? –  dgw Sep 6 '11 at 1:54
    
Yes, I used the wrong one, thank you. I've also seen some setups where it's deny all (whitelist) and if you need something it has to go to an approval board and you have to plead your case with why you feel your recommended additions need to be added. –  ITOps Sep 6 '11 at 2:26
add comment

Yes, they're trying to block port forwarding. This kind of thing has always made little sense to me, especially since things like stunnel exist. Incidentally, if you can get to any SSL site on the Internet (without a cert error, and without a custom root cert installed by your IT department), then you can likely tunnel out to almost anywhere using any protocol inside of an stunnel. This is the principle that things like LogMeIn use.

See the HTTP Connect verb for more, and in general, this: https://secure.wikimedia.org/wikipedia/en/wiki/Tunneling_protocol

share|improve this answer
add comment

It is also important to note that "schools" may include research-intensive universities where network services are critical for tax-funded research, especially in computer science/engineering. In addition, IT departments are commonly funded by overhead returned from research grants. An overly secure network can interfere with research activity and with the delivery of online services from research groups. Implementation of a "white list" policy is more than a nuisance in the distributed, collaborative world of academic research. It is a plan for going out of business.

Fortunately, at most research universities the faculty play a strong role in institutional management, and overly restrictive policies generally won't survive long. At smaller universities, colleges or technical schools, such policies may be convenient but will likely interfere with any attempted "legitimate" research.

As a tenured professor myself, any SSH restrictions would force me to shut down my lab and take my work elsewhere. Even if a "white-list" policy is available, I simply will not allow the operations of a research laboratory to be held under the control of some guy from IT. I'm posting this answer in the hope that an IT administrator might see it, and think twice before implementing any policies that may contradict institutional missions.

share|improve this answer
add comment

I worked as a Network Security Admin in a college in my town.

Of course policies were created to allow students,guest,staff and teachers ..etc the necessary freedoms of using the Internet.

One of our Security class/lab was set up with an outside dsl line for that very freedom that our firewall and internal security devices would otherwise not allow.

For the original question asked, a problem with forwarding ssh to http is that eventually the security guys will see how much traffic is being used by that IP , thats if you are using ssh redirect for downloads ..etc.

share|improve this answer
    
@ ce_prof I understand your concern and I have had many discussions about this topic. One thing you have to realize is that the Universities networks are prime sources of zombie machines and hacking launch locations nationwide. The same freedom that allows internet freedom to students or any user in the school system is one of the largest weaknesses affecting us all. –  Darkmatter Oct 11 '12 at 1:43
    
Only the last paragraph really responds to the question, and I'm not sure it is fully responsive. "the security guys will catch you" isn't a security implication per se. Having said that, I think that the "necessary freedoms" phrase in the second paragraph and the drivers for the architecture in the second paragraph might be informative for the OP. –  Mark C. Wallace Oct 11 '12 at 11:24
1  
Sorry, let me clear that statement "the security guys will catch you". If there is a traffic shaping device on the network which major schools have, the usage of data/traffic will flag your IP address. Most Security/Network admins will analyze this traffic and usually detect non-compliance (port redirection..etc). Bypassing internet use policies is usually frowned upon because most of the time users who use these methods (I have been there) are downloading things they shouldn't or using the school network for devious goals. I am not saying all are but from my experience most are. –  Darkmatter Oct 11 '12 at 13:27
    
Also, SSH may be restricted because of fear of internal hacks/connections to school devices if they are in the same lan which most schools are lazy to separate student and production lans. –  Darkmatter Oct 11 '12 at 13:30
add comment

SSH is often used for "firewall peircing", i.e., offering forward tunnels to access arbitrary resources outside the network, or worse, offering reverse tunnels to expose internal resources. Yes, you could tunnel over SSL too, but as others suggested, SSH is built to tunnel.

Two suggestions:

  1. Have you asked the security admin how you would obtain an exception? Given you have a legitimate need for SSH, you're probably not the target audience for the block. If the security admin can't approve the exception, ask them who could.

  2. You may be able to use github over SSL:

http://stackoverflow.com/questions/3777075/https-github-access

(ignore the comments about SSH over 443, I know you mentioned they're using DPI to stop your SSH)

Heroku offers a web console, but I'm not sure if it would be sufficient.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.