The stunnel utility written by Michał Trojnara allows, if I understand correctly, to "wrap" non-SSL protocols (such as
ssh) in an SSL connection.
For example, imagine that all network ports on a network are blocked except the ports
443 for HTTP and HTTPS traffic respectively. Deep packet inspection is also used to ensure that both the ports are only used for HTTP(S) and nothing else, so you can't just run an SSH server on port 443 and expect it to be able to connect through this firewall.
stunnel can be used in this case by running an
stunnel listener on port 443 of the server (bound to internal port 22) and using the
stunnel client to connect to port 443 of the server, in fact connecting to its SSH daemon. The firewall has no idea that this happens because
- The connection is encrypted and integrity-checked by design, so the firewall does not know what data is being exchanged - HTTP or not.
- Because it is an SSL connection and is running over 443, the server cannot make the distinction between an HTTPS server and say, ssh.
My question is - what would be a way to actually detect the usage of
stunnel and block it? Let's assume that methods of analysis such as looking at patterns of data (hmm, a lot of data exchange is unusual over an HTTPS connection, so this SSL tunnel must be used for something else) are unavailable. We also cannot install software or certs onto user's devices.
Is there really any practical way to stop this, considering that keeping HTTPS working is crucial?