Skip to main content
Information Security

Return to Question

Tweeted twitter.com/StackSecurity/status/751326821719957504
added 2 characters in body; edited title; added 2 characters in body
Source Link
techraf
techraf
  • 9.2k
  • 11
  • 46
  • 63

Making sshSSH warn of MITM monitoring

I am a bit of a newbee with ssh+securitySSH+security, so I'm not sure if the assumptions in the following question are entirely correct...

I am in a hotel which uses zscaler.comzscaler.com to monitor its guests' internet connections. My computer uses Windows 7, but I am running a VMWare guest with Fedora 23.

In the VMWare/Fedora guest I have set up Firefox to use a socks proxy:

ssh -ND 9876 [email protected]

Within Firefox, I have set

network.proxy.socks_remote_dns --> true
network.proxy.socks_port --> 9876
network.proxy.socks --> localhost
network.proxy.type --> 1

I had thought that using a socks proxy like this would prevent MITM monitoring of Firefox's web surfing, but it doesn't: for some web pages (e.g. totalvpn.comtotalvpn.com), I get the hotel's warning page saying that the site I'm linking to is on their "forbidden" list.

When I started the socks proxy, as above, I got no warning that the link was not secure. Is there a way to force sshSSH to use a secure link or fail if it can't?

Making ssh warn of MITM monitoring

I am a bit of a newbee with ssh+security, so I'm not sure if the assumptions in the following question are entirely correct...

I am in a hotel which uses zscaler.com to monitor its guests' internet connections. My computer uses Windows 7, but I am running a VMWare guest with Fedora 23.

In the VMWare/Fedora guest I have set up Firefox to use a socks proxy:

ssh -ND 9876 [email protected]

Within Firefox, I have set

network.proxy.socks_remote_dns --> true
network.proxy.socks_port --> 9876
network.proxy.socks --> localhost
network.proxy.type --> 1

I had thought that using a socks proxy like this would prevent MITM monitoring of Firefox's web surfing, but it doesn't: for some web pages (e.g. totalvpn.com), I get the hotel's warning page saying that the site I'm linking to is on their "forbidden" list.

When I started the socks proxy, as above, I got no warning that the link was not secure. Is there a way to force ssh to use a secure link or fail if it can't?

Making SSH warn of MITM monitoring

I am a bit of a newbee with SSH+security, so I'm not sure if the assumptions in the following question are entirely correct...

I am in a hotel which uses zscaler.com to monitor its guests' internet connections. My computer uses Windows 7, but I am running a VMWare guest with Fedora 23.

In the VMWare/Fedora guest I have set up Firefox to use a socks proxy:

ssh -ND 9876 [email protected]

Within Firefox, I have set

network.proxy.socks_remote_dns --> true
network.proxy.socks_port --> 9876
network.proxy.socks --> localhost
network.proxy.type --> 1

I had thought that using a socks proxy like this would prevent MITM monitoring of Firefox's web surfing, but it doesn't: for some web pages (e.g. totalvpn.com), I get the hotel's warning page saying that the site I'm linking to is on their "forbidden" list.

When I started the socks proxy, as above, I got no warning that the link was not secure. Is there a way to force SSH to use a secure link or fail if it can't?

Source Link
Richard Sullivan
Richard Sullivan
  • 21
  • 1

Making ssh warn of MITM monitoring

I am a bit of a newbee with ssh+security, so I'm not sure if the assumptions in the following question are entirely correct...

I am in a hotel which uses zscaler.com to monitor its guests' internet connections. My computer uses Windows 7, but I am running a VMWare guest with Fedora 23.

In the VMWare/Fedora guest I have set up Firefox to use a socks proxy:

ssh -ND 9876 [email protected]

Within Firefox, I have set

network.proxy.socks_remote_dns --> true
network.proxy.socks_port --> 9876
network.proxy.socks --> localhost
network.proxy.type --> 1

I had thought that using a socks proxy like this would prevent MITM monitoring of Firefox's web surfing, but it doesn't: for some web pages (e.g. totalvpn.com), I get the hotel's warning page saying that the site I'm linking to is on their "forbidden" list.

When I started the socks proxy, as above, I got no warning that the link was not secure. Is there a way to force ssh to use a secure link or fail if it can't?