2

I've a device that's running an HTTP server. It doesn't have a fully qualified domain name, and installing a self-signed certificate on every client is tedious. In other words, no HTTPS.

I've blocked ingress traffic to the server's HTTP ports, and am currently connecting to it via an SSH tunnel.

When using an SSH tunnel, from my client device to device A, to access and use plain-text HTTP forms on a web server running on that device A, are my communications secure?

  • 2
    Why not just get a freedns subdomain and then a certificate from letsencrypt using that subdomain? – ig-dev Oct 31 '19 at 12:33
  • 1
    Is this for a company setting? If so, your company should have an internal CA, which is automatically added to every company device upon enrollment. A certificate signed by this internal CA would be trusted by clients. – MechMK1 Oct 31 '19 at 12:47
  • "secure" from what? – schroeder Oct 31 '19 at 13:21
  • It's behind a NAT device without port forwarding. There isn't an internal CA. freedns is an interesting choice. I didn't realise you could have a public domain name pointing to a private address. – Dominykas Mostauskis Oct 31 '19 at 14:05
4

Yes, they are secure. The known_hosts will protect you from a Man-in-The-Middle attack by checking the remote servers fingerprint (assuming you have not deactivated this check), and the communication is encrypted using an algorithm such as AES128 (may vary).

The fingerprint check serves as a proof that the server still possesses the private/public key pair from when the host was listed as a known_host. Without the private key it is not possible for an attacker (MiTM) to forge the fingerprint and pass this check. This check only works, of course, if you can guarantee that you were connected to the right host when it was listed as known, and not to a man-in-the-middle.

| improve this answer | |
  • If your ssh client connects to a server, the server presents a fingerprint, not a certificate. The purpose of a certificate is to be able to relay trust - which is the problem OP had in the first place. Fingerprint checks just ensure that the server did not change from a known state (e.g. because the server was re-installed). And checking the fingerprint would require an out-of-band check. – MechMK1 Oct 31 '19 at 13:07
  • Together with MechMK's comment this answers my question. I was largely asking about whether "127.0.0.1:80/admin" type surfing exposes anything sniffable to others in your local network, but at the time of asking I couldn't formulate the question. Since noone has mentioned this, I think I can presume that it's not the case. – Dominykas Mostauskis Oct 31 '19 at 14:10
  • The only thing sniffable is that you are connected and that there is a tunnel with traffic, but none of the communicated content, which is encrypted (like mentioned in the answer). – ig-dev Oct 31 '19 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.