What are the risks associated with SSH'in from corporate LAN to untrusted server on the Internet

Question

At work (a huge organisation) I found a server on the LAN that opens SFTP connections to 2 servers across the Internet.

I assume the remote hosts are in the other parties DMZ.

I know you are not supposed to do this but I am not sure of the associated risks.

How much more risky is it to SSH (SFTP) to a remote host from your LAN than from your DMZ.

About the only thing I can think of is having the firewall rule that allows it could allow someone on this side to setup a reverse SSH session so they could get on the LAN from the outside with no audit trail.

Thanks. sean

Answer 1

You've identified the main risks:

1. You're contacting a foreign host/network.

2. It is very easy to create a reverse tunnel using SSH (so the remote party can get to you)

(3. Communication stream is encrypted) ... my additional risk.

With regards to LAN vs. DMZ. Well.. of course, it all depends. On some LANs there might be more inspection with regards to outbound connects (?). I mean, it really depends on your own setup, policies, etc.

Anytime you have "trusted" going to "non-trusted" (no matter what zone), you have the risks already mentioned. Encrypting the traffic doesn't really matter as much, though it can often times confuse the issue (makes people forget that whole "trusted" going to "non-trusted" issue).

But, "are you supposed to do this?"

You effectively said "no", but again, it all depends. The Internet is essentially a public trusted network. We use it because it's there. Not because it provides safety. Thus, by definition, by default, it's certainly in the "untrusted" category for most companies. But maybe we get enough benefit to mitigate (perception wise) the risks (??).

Firewall wise, btw, when an connection is initiated from the company (trusted) to the outside (untrusted), it is very difficult to "block" any nastiness. And because the communication is encrypted, I'd say it is very very very difficult.

Answer 2

It depends on how much additional security you get from the DMZ.

• In your situation an encrypted TCP socket is basically proxied directly to the LAN. In that case a DMZ is more or less useless. Attacks on SSH and the FTP protocol are possible, as well as attacks on the application protocol;
• If you just use the DMZ to forward a connection then you may be secure against direct attacks that are directly attacking the SSH protocol & implementation;
• If you use a server in the DMZ to perform the FTP - i.e. if you use the DMZ to perform the FTP on files pushed to / pulled from the DMZ - then you may be secure against direct attacks on SFTP;
• The DMZ may also inspect or scan the files that are retrieved adding some application level security;
• The DMZ may perform some additional logging and detection, which can be inspected / monitored at a central location.

So if you don't use the DMZ then you are simply dependent on the service in the LAN and the actual application that uses the files. Using the DMZ may add a layer of security.

Of course, setting up an SFTP server on the LAN is a bit more troublesome as it will require opening up the firewall to incoming connections.