1

Recently as we started contributing to a project hosted on GitHub we observed that there are problems with connecting securely:

$ ssh -T git@github.com
Connection closed by 192.30.253.112 port 22

We had to repeat connection attempt several times at the beginning of every day, and then it was working for the rest of the day. We contacted IT department and they said something like that: "OK, we will add filter not to decrypt ssh keys for GitHub". Since then GitHub is working fine, but I'm scared to use the computer inside the company network even to open my email.

Other ssh related example:

$ ssh -v  ******@*****.home.pl
OpenSSH_7.6p1 Ubuntu-4, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to *****.home.pl [***.***.220.52] port 22.
debug1: Connection established.
debug1: identity file /home/goto/.ssh/id_rsa type 0
debug1: key_load_public: No such file or directory
debug1: identity file /home/goto/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/goto/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/goto/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/goto/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/goto/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/goto/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/goto/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4
debug1: Remote protocol version 2.0, remote software version HomeSSH-v1.2
debug1: no match: HomeSSH-v1.2
debug1: Authenticating to *****.home.pl:22 as '*****'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: ecdh-sha2-nistp256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: aes128-ctr MAC: hmac-sha2-256 compression: none
debug1: kex: client->server cipher: aes128-ctr MAC: hmac-sha2-256 compression: none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:iiQ18jC************dyxJJ4FhOWK/1o
The authenticity of host '*****.home.pl (***.***.220.52)' can't be established.
ECDSA key fingerprint is SHA256:iiQ18jC*********dyxJJ4FhOWK/1o.

Today I wanted to use NordVPN to be able to safely use my private e-mail, but even there I have a problem connecting:

$ sudo openvpn /etc/openvpn/ovpn_tcp/us327.nordvpn.com.tcp.ovpn 
Mon Jul  9 13:26:42 2018 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 10 2018
Mon Jul  9 13:26:42 2018 library versions: OpenSSL 1.1.0g  2 Nov 2017, LZO 2.08
Enter Auth Username: **********
Enter Auth Password: **********
Mon Jul  9 13:26:55 2018 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Mon Jul  9 13:26:55 2018 NOTE: --fast-io is disabled since we are not using UDP
Mon Jul  9 13:26:55 2018 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul  9 13:26:55 2018 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul  9 13:26:55 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]104.145.235.35:443
Mon Jul  9 13:26:55 2018 Socket Buffers: R=[87380->87380] S=[16384->16384]
Mon Jul  9 13:26:55 2018 Attempting to establish TCP connection with [AF_INET]104.145.235.35:443 [nonblock]
Mon Jul  9 13:26:56 2018 TCP connection established with [AF_INET]104.145.235.35:443
Mon Jul  9 13:26:56 2018 TCP_CLIENT link local: (not bound)
Mon Jul  9 13:26:56 2018 TCP_CLIENT link remote: [AF_INET]104.145.235.35:443
Mon Jul  9 13:27:56 2018 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Jul  9 13:27:56 2018 TLS Error: TLS handshake failed
Mon Jul  9 13:27:56 2018 Fatal TLS error (check_tls_errors_co), restarting
Mon Jul  9 13:27:56 2018 SIGUSR1[soft,tls-error] received, process restarting
Mon Jul  9 13:27:56 2018 Restart pause, 5 second(s)
Mon Jul  9 13:28:01 2018 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Mon Jul  9 13:28:01 2018 NOTE: --fast-io is disabled since we are not using UDP
Mon Jul  9 13:28:01 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]104.145.235.35:443
Mon Jul  9 13:28:01 2018 Socket Buffers: R=[87380->87380] S=[16384->16384]

I'm sure it is related to some company policy and settings on the firewall. The question is the IT department doing there and what are security threat related to that. Is my SSL web traffic exposed? What can I do to use secure internet access (or how do I connect NordVPN)?

  • 9
    "...related to some company policy..." - Traffic inspection including SSL interception is common in companies and even many desktop antivirus does this. "What can I do to use secure internet access" - There is probably a policy in the company regarding the use of company network things which are not related to the work (like reading private mail). Check first if what you want to do is legal in this policy. If it is ask your IT staff if there is a way to do your private things w/o SSL interception. – Steffen Ullrich Jul 9 '18 at 11:59
  • 7
    These are all questions for your IT department. – schroeder Jul 9 '18 at 12:01
  • 4
    "OK, we will add filter not to decrypt ssh keys for GitHub" - yes, they are decrypting at the perimeter – schroeder Jul 9 '18 at 12:27
  • 2
    This is really pretty easy to check. Go to a https site, inspect the certificate, is the root CA certificate real, or something else? They are probably blocking encrypted connections that they can't decrypt. They are not actually attacking the encryption. They can not decrypt traffic for which they do not have a key. – trognanders Jul 9 '18 at 17:13
  • 2
    Trying to circumvent this snooping is going to be considered not cool, regardless of how entitled you feel to do so. It will look like you are stealing data or something. The official solution is going to be something obvious like, don't do anything on your work computer that is not your employers business. Pragmatically, check your home email on your phone. – trognanders Jul 9 '18 at 17:17
3

None of your examples show whether or not they're intercepting traffic, other than their statement about github. The only way to know for sure is to try to make a connection and check if the public key you receive is the legitimate one for that connection. (Obtained securely.)

Most companies have a policy prohibiting you from attempting to circumvent their security controls, I would not suggest attempting to connect to a service like NordVPN on your company's equipment.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.