3 ms·

That's likely to be a firing offence, no? If I were running things I wouldn't want employees deliberately subverting my network's security measures in the name

That's likely to be a firing offence, no? If I were running things I wouldn't want employees deliberately subverting my network's security measures in the name of their own convenience. If you have to spend time wrestling the VPN while you're on the clock, that's their own time being wasted.

deleted 7y ago
[deleted]
kazinator 7y ago
All you would have to do is disallow outbound SSH.
- MaxBarraclough 7y ago
  Sure, but if you break your employer's cybersecurity policies, you don't get to blame IT for failing to prevent you from doing it.
  - kazinator 7y ago
    Using outbound SSH when that is allowed is compliance with cybersecurity policy.
- acdha 7y ago
  That's tricky, though, since there are many uses for SSH which are not circumventing security policy — blocking outbound SSH would also mean you couldn't use Git, manage servers in the cloud or other locations, transfer files, etc. Using this to circumvent policy is exactly the kind of move which would lead to those other uses being banned and making life worse for all of your coworkers.
  - kazinator 7y ago
    > blocking outbound SSH would also mean you couldn't use Git, manage servers in the cloud or other locations, transfer files, etc. That's right, and that's how it is with my current employer. If you need outbound SSH to work with Git, that probaly means you're working on a side project, not work. Fetching public code needed for work from a hosting site can be done over https. Managing servers in the cloud, ditto. If managing servers in the cloud isn't part of your job description, why would your workplace enable that?
- m463 7y ago
  That would be cat and mouse. You can ssh on any port. But I agree that it's not a good idea to poke holes in your corporate firewall (which is really what this is doing).
  - kazinator 7y ago
    If you think that's poking holes in the firewall, you should see this javascript stuff that worms itself back over most of your HTTPS connections from countless third-party sites.
packetslave 7y ago
Maybe not a firing offense, but if you ran 'ssh -R' at $JOB-1, you'd pretty much immediately have someone from the security ops team messaging you to ask what you're up to.

deleted 7y ago

[deleted]

kazinator 7y ago

All you would have to do is disallow outbound SSH.

MaxBarraclough 7y ago
Sure, but if you break your employer's cybersecurity policies, you don't get to blame IT for failing to prevent you from doing it.
- kazinator 7y ago
  Using outbound SSH when that is allowed is compliance with cybersecurity policy.
acdha 7y ago
That's tricky, though, since there are many uses for SSH which are not circumventing security policy — blocking outbound SSH would also mean you couldn't use Git, manage servers in the cloud or other locations, transfer files, etc. Using this to circumvent policy is exactly the kind of move which would lead to those other uses being banned and making life worse for all of your coworkers.
- kazinator 7y ago
  > blocking outbound SSH would also mean you couldn't use Git, manage servers in the cloud or other locations, transfer files, etc. That's right, and that's how it is with my current employer. If you need outbound SSH to work with Git, that probaly means you're working on a side project, not work. Fetching public code needed for work from a hosting site can be done over https. Managing servers in the cloud, ditto. If managing servers in the cloud isn't part of your job description, why would your workplace enable that?
m463 7y ago
That would be cat and mouse. You can ssh on any port. But I agree that it's not a good idea to poke holes in your corporate firewall (which is really what this is doing).
- kazinator 7y ago
  If you think that's poking holes in the firewall, you should see this javascript stuff that worms itself back over most of your HTTPS connections from countless third-party sites.

packetslave 7y ago

Maybe not a firing offense, but if you ran 'ssh -R' at $JOB-1, you'd pretty much immediately have someone from the security ops team messaging you to ask what you're up to.