1

I recently stayed at a hotel where outbound SSH traffic (and seemingly only SSH traffic) was blocked on the guest WiFi network, and I'm trying to figure out what security-based rationale they might have had for this policy. Unfortunately, I could not ask the hotel about this myself as the staff spoke very little English, and in any case probably wouldn't have put me in touch with their IT people.

At this hotel, access to the WiFi network required a unique username and password, assigned to individual guests at the check-in desk and valid only for five hours at a time. Once logged in, I was able to make connections to remote hosts using nearly all my usual protocols (DNS, HTTP(S), IMAP(S), SMTP, IRC, OpenVPN, etc.) on both standard and non-standard ports. The only exception I found was that SSH traffic was blocked—and I really do mean that the hotel was analyzing connections for SSH traffic, not simply blocking port 22. Through experimentation, I discovered that I could not connect via SSH to any host, even if the SSH server was listening on (say) port 80, and conversely, I could make HTTP connections to HTTP servers listening on port 22. The only way I could make SSH connections was through a VPN, since VPN traffic (and the usual OpenVPN ports) was not blocked.

I'm struggling to understand the rationale for such a fine-grained policy. What particular security threat might the hotel have been trying to protect itself against? The only thing I can think of is that they were running their own SSH servers and didn't want any guests trying to break into them. But since all WiFi access requires a username and password, surely they could simply have had their SSH server block connections from those internal IPs assigned to guest accounts. (And of course they could also take the usual precautions, such as disabling password authentication, using fail2ban or similar software to block brute-force attacks, etc.). I can't have been the only guest who was inconvenienced by the inability to SSH into my home and work computers.

(Note that there is a somewhat similar question here about schools blocking SSH. However, the answers there suggest that the schools are trying to prevent users from piercing their firewalls to access restricted remote content or services. This doesn't seem to be the case with my hotel, since they don't seem to be blocking any non-SSH traffic or content, including VPN traffic.)

3
  • 1
    It is impossible to tell what the specific reason is in your case, one can only speculate. Maybe they started with a restrictive firewall policy as is not uncommon in hotels, i.e. only allow what is needed for web and mail. And then they opened up the policy step by step because guests complained. Maybe nobody complained enough about the SSH restriction yet. Commented Dec 10, 2022 at 16:09
  • 1
    As Steffen says, it's impossible to answer for sure, but your question assumes rationality, and there's no evidence for that here. Commented Dec 10, 2022 at 17:01
  • 1
    There's no need to invoke malicious intent to something which could be explained by stupidity or mistake. Commented Dec 11, 2022 at 11:00

0

Browse other questions tagged .