2

I am a bit of a newbee with SSH+security, so I'm not sure if the assumptions in the following question are entirely correct...

I am in a hotel which uses zscaler.com to monitor its guests' internet connections. My computer uses Windows 7, but I am running a VMWare guest with Fedora 23.

In the VMWare/Fedora guest I have set up Firefox to use a socks proxy:

ssh -ND 9876 me@my-isp.com

Within Firefox, I have set

network.proxy.socks_remote_dns --> true
network.proxy.socks_port --> 9876
network.proxy.socks --> localhost
network.proxy.type --> 1

I had thought that using a socks proxy like this would prevent MITM monitoring of Firefox's web surfing, but it doesn't: for some web pages (e.g. totalvpn.com), I get the hotel's warning page saying that the site I'm linking to is on their "forbidden" list.

When I started the socks proxy, as above, I got no warning that the link was not secure. Is there a way to force SSH to use a secure link or fail if it can't?

2

You didn't give all the necessary information. It could be that Firefox is just incorrectly configured and does not use the proxy at all. Given that Firefox is setup correctly, which it sounds like, this is what I think is most likely.


Firefox tunnels the traffic nicely through SSH, you can verify this by going to a website like whatismyip.com.

What does not get tunneled are DNS requests. This is a known problem and projects like Tor (the anonymity network) work around it by providing a custom browser that does not leak DNS requests.

So what happens is that your browser asks your operating system for the website's IP address, which will query the local DNS servers (and using custom DNS servers might not help if they do DNS MITMing, which is not uncommon). The local DNS servers will then return some IP address which, when fetching the page, gives you the hotel's fascist firewall page.

Local IP addresses usually are in Firefox' ignore list by default, so they won't go through the proxy, and that's why you can see the page at all. If it had gone through the proxy, your SSH server would probably have gone "I can't reach this IP address" and you'd be none the wiser.

When I started the socks proxy, as above, I got no warning that the link was not secure. Is there a way to force ssh to use a secure link or fail if it can't?

When using HTTPS you know your connection is secure, unless:

  1. you installed software from the hotel to get on the internet;
  2. installed a security certificate;
  3. there is a warning sign (or something like that) on the padlock in your address bar; or
  4. you ignore "this page is not secure" warnings.

When using HTTP you should not rely too much on its security, but I agree, it's nicer to be on a trusted network. Unfortunately HTTP has no mechanism to verify that nobody reads along, so no warning could ever be given.

  • > You didn't give all the necessary information. – Richard Sullivan Jul 4 '16 at 20:58
  • > You didn't give all the necessary information. >> Sorry, I tried to give all the relevant info. What other info should I give? My suspicion is that it is not a Firefox issue, but an SSH issue. However, I recognize that I could be completely wrong about that. RE: Firefox DNS requests: I had thought that "network.proxy.socks_remote_dns --> true" would force Firefox DNS requests to go through the SOCKS proxy. – Richard Sullivan Jul 4 '16 at 21:14
  • @RichardSullivan Oh I'm sorry, I had missed the socks_remote_dns=true part. I guess this makes what I said impossible, so it must be something else. You could post a screenshot showing all the settings, check whatismyip.com (or a similar site) to see whether the proxy is being used at all... I don't know, there's lots of stuff that could be configured wrong I guess. But at some point it changes from Q&A to remote tech support, which I would not mind giving, but is unfortunately not allowed on the site. – Luc Jul 4 '16 at 23:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.