What security implications are there for allowing outbound SSH traffic?

Question

My school currently blocks outbound SSH traffic. Users inside the network cannot use Port 22, and attempting to make an SSH connection over another port is also blocked. (I'm assuming the firewall drops any packets that seem to use the SSH protocol.)

The excuse given for this is that allowing outbound SSH traffic would put users inside the network at risk, and that it would allow "port forwarding". (Their words not mine) Translated, I think the administrators are worried that a virus on a user's computer might try to use SSH to contact Command and Control servers. I think they also want to keep the port closed because it could be used for proxy connections, TOR, and the like.

To my knowledge, most of the present-day "active" viruses aren't using SSH for C&C. Also, a proxy could be established over any port, could it not? Such as 80, which is of course already open for regular internet browsing?

I understand that there are implications of inbound SSH connections, but I don't see how not allowing students to make outbound connections really improves security all that much. For one, it prevents me from using Github and Heroku, which I need for my outside job.

Could someone please respond with either more, better reasons why outbound SSH should be blocked or (preferably) with reasons why this network policy is irrational?

Answer 1

I think they also want to keep the port closed because it could be used for proxy connections, TOR, and the like.

Yes, that's the most likely explanation.

It is possible that malware would go outbound using SSH to hide it's traffic. It's also possible that malware, or users, could use SSH remote port forwarding to permit "inbound" connections that are blocked by the firewall. These are valid but probably lesser concerns for your school.

Their primary issue with SSH is probably not that it allows these tunnels, which as you point out could go over other ports and other protocols, but that it hides them beneath encryption, and blocks the ability of the administrator to control what the network is used for. While other tools can do this too, SSH is "out of the box" and represents low hanging fruit for them to block.

Could someone please respond with either more, better reasons why outbound SSH should be blocked or (preferably) with reasons why this network policy is irrational?

Their technical reasons are valid but possibly a little specious for (a school's) level of security requirements. The administrative reasons are valid to them, but irrational to you. Unfortunately for you, it's their network.

Where I expect you'll be tunneling SSH-over-SSL sometime soon.

Answer 2

It is also important to note that "schools" may include research-intensive universities where network services are critical for tax-funded research, especially in computer science/engineering. In addition, IT departments are commonly funded by overhead returned from research grants. An overly secure network can interfere with research activity and with the delivery of online services from research groups. Implementation of a "white list" policy is more than a nuisance in the distributed, collaborative world of academic research. It is a plan for going out of business.

Fortunately, at most research universities the faculty play a strong role in institutional management, and overly restrictive policies generally won't survive long. At smaller universities, colleges or technical schools, such policies may be convenient but will likely interfere with any attempted "legitimate" research.

As a tenured professor myself, any SSH restrictions would force me to shut down my lab and take my work elsewhere. Even if a "white-list" policy is available, I simply will not allow the operations of a research laboratory to be held under the control of some guy from IT. I'm posting this answer in the hope that an IT administrator might see it, and think twice before implementing any policies that may contradict institutional missions.

Answer 3

I'd say that 90%+ of the time you encounter an argument like that in regards to tunneling, especially in a school, the goal is to prevent you form tunneling out. If you can tunnel, then you can bypass their webfilter. If you can, somebody else will. Then after enough folks catch on, some twit will watch porn in the library, get in trouble, and somebody will be asking the sysadmin how the hell that could happen.

Answer 4

Yes, they're trying to block port forwarding. This kind of thing has always made little sense to me, especially since things like stunnel exist. Incidentally, if you can get to any SSL site on the Internet (without a cert error, and without a custom root cert installed by your IT department), then you can likely tunnel out to almost anywhere using any protocol inside of an stunnel. This is the principle that things like LogMeIn use.

See the HTTP Connect verb for more, and in general, this: https://secure.wikimedia.org/wikipedia/en/wiki/Tunneling_protocol

Answer 5

I worked as a Network Security Admin in a college in my town.

Of course policies were created to allow students,guest,staff and teachers ..etc the necessary freedoms of using the Internet.

One of our Security class/lab was set up with an outside dsl line for that very freedom that our firewall and internal security devices would otherwise not allow.

For the original question asked, a problem with forwarding ssh to http is that eventually the security guys will see how much traffic is being used by that IP , thats if you are using ssh redirect for downloads ..etc.

Answer 6

In a school environment where the pipes are large it's best to lock things down. If not people (students, faculty and others) will install p2p software, illegal software and do other things that can raise the liability for the school, cost people their jobs to fuel personal interests without taking into account how it would affect the enterprise.

There are also the need to prevent access to unsafe websites, malware detection, etc. as much as possible in an enterprise school network. As one mess-up by one student could potentially affect all others, especially if computers are on a domain. The system and network administrators main priorities are to keep things available, secure, non congested, safe and to meet the needs of Senior Management (deans, vps, presidents, etc.).

Normally it's safer to do a whitelist instead of a blacklist in terms of security, but it can also be frustrating to those wanting to have fun or do legitimate research. There should be a formal request process procedure to request access to certain sites and having certain protocols opened with justification (professor needs it from 9am to 2pm, or wants to do a live demonstration of something of that nature).

There will always have to be work to maintain a balance between security and useability with security coming before usability if something is known to be unsafe like allowing ftp and other non secure protocols for authentication.

Answer 7

SSH is often used for "firewall piercing", i.e., offering forward tunnels to access arbitrary resources outside the network, or worse, offering reverse tunnels to expose internal resources. Yes, you could tunnel over SSL too, but as others suggested, SSH is built to tunnel.

Two suggestions:

1. Have you asked the security admin how you would obtain an exception? Given you have a legitimate need for SSH, you're probably not the target audience for the block. If the security admin can't approve the exception, ask them who could.

2. You may be able to use GitHub over SSL. Ignore the comments about SSH over port 443; I know you mentioned they're using DPI to stop your SSH.

Heroku offers a web console, but I'm not sure if it would be sufficient.