I am looking to test a DPI (deep packet inspector). I currently have it set up to block SSH connections (which it does successfully).

I have learned that DPI can be bypassed by obfuscating/encrypting the initial handshake (I think, feel free to correct). By doing this, the DPI is not able to tell that the traffic is SSH and does not block it. How can achieve this with macOS?

I have complete control over both the server and the client.


Your question seems to be answered on Apple Stack Exchange. Note that the patch mentioned there seems to be no longer maintained, so it may have security issues if you do not backport fixes. A more up-to-date patch (supporting OpenSSH 7.6 as of this answer) is available on GitHub.* This particular obfuscated protocol is explained in more detail on its site. Judging by a quick read of the patch, this particular obfuscation seems to add a random length of padding to packets and encrypt the handshake using a preshared key stored in the configuration file of both the client and server. It is not particularly advanced, but will likely hamper automated protocol detection.

There are other ways to obfuscate SSH traffic as well. You could create an obfuscated VPN tunnel between the client and server and connect with SSH through that. I explained in another answer how to prevent OpenVPN traffic from being detected as such. You could use the techniques outlined in it (static keys and obfsproxy) to create a tunnel through which SSH can run. You need only a basic understanding of networking to bring up a virtual interface for the tunnels and assign a local IP to it so you can connect using your SSH utility. You can also use obfsproxy directly on SSH.

It's important to remember that, while protocol obfuscation can make automated detection or censorship more difficult, it does little to prevent an intelligent analyst with access to traffic dumps from realizing that the traffic is OpenSSH traffic. There is not much you can do to protect against such a threat while maintaining usability. All obfuscation does is raise the bar for detection.

* Applying a patch requires you know how to compile software from source code. You download the source code for the exact version targeted by the patch, and use a command to apply the patch, such as the patch utility.

  • I had found that before, but for the reasons you pointed out it does not seem too secure. I am not familiar with back porting fixes. Could you assist with that? – JBis Jul 12 '18 at 3:38
  • @JBis I cannot, sorry. However, the other patch I linked to is much newer, supporting 7.6. – forest Jul 12 '18 at 3:40
  • I am also not sure how to set it up on the server. – JBis Jul 12 '18 at 3:40
  • What operating system is the server running? – forest Jul 12 '18 at 3:40
  • macOS (Server) :) – JBis Jul 12 '18 at 3:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.