Making SSH warn of MITM monitoring

Question

I am a bit of a newbee with SSH+security, so I'm not sure if the assumptions in the following question are entirely correct...

I am in a hotel which uses zscaler.com to monitor its guests' internet connections. My computer uses Windows 7, but I am running a VMWare guest with Fedora 23.

In the VMWare/Fedora guest I have set up Firefox to use a socks proxy:

ssh -ND 9876 [email protected]

Within Firefox, I have set

network.proxy.socks_remote_dns --> true
network.proxy.socks_port --> 9876
network.proxy.socks --> localhost
network.proxy.type --> 1

I had thought that using a socks proxy like this would prevent MITM monitoring of Firefox's web surfing, but it doesn't: for some web pages (e.g. totalvpn.com), I get the hotel's warning page saying that the site I'm linking to is on their "forbidden" list.

When I started the socks proxy, as above, I got no warning that the link was not secure. Is there a way to force SSH to use a secure link or fail if it can't?

Answer 1

You didn't give all the necessary information. It could be that Firefox is just incorrectly configured and does not use the proxy at all. Given that Firefox is setup correctly, which it sounds like, this is what I think is most likely.

---

Firefox tunnels the traffic nicely through SSH, you can verify this by going to a website like whatismyip.com.

What does not get tunneled are DNS requests. This is a known problem and projects like Tor (the anonymity network) work around it by providing a custom browser that does not leak DNS requests.

So what happens is that your browser asks your operating system for the website's IP address, which will query the local DNS servers (and using custom DNS servers might not help if they do DNS MITMing, which is not uncommon). The local DNS servers will then return some IP address which, when fetching the page, gives you the hotel's fascist firewall page.

Local IP addresses usually are in Firefox' ignore list by default, so they won't go through the proxy, and that's why you can see the page at all. If it had gone through the proxy, your SSH server would probably have gone "I can't reach this IP address" and you'd be none the wiser.

When I started the socks proxy, as above, I got no warning that the link was not secure. Is there a way to force ssh to use a secure link or fail if it can't?

When using HTTPS you know your connection is secure, unless:

1. you installed software from the hotel to get on the internet;
2. installed a security certificate;
3. there is a warning sign (or something like that) on the padlock in your address bar; or
4. you ignore "this page is not secure" warnings.

When using HTTP you should not rely too much on its security, but I agree, it's nicer to be on a trusted network. Unfortunately HTTP has no mechanism to verify that nobody reads along, so no warning could ever be given.