3 ms·
Block any TCP protocol starting with string "SSH-" Problem solved. Seriously people think SSH or VPN is advanced? Every clear text handshake protocol could be
by est 13y ago
Block any TCP protocol starting with string "SSH-"
Problem solved.
Seriously people think SSH or VPN is advanced? Every clear text handshake protocol could be blocked at ease.
- tokenizerrr 13y agoSure, then SSH is blocked. SSH is very necessary in the day to day work for a ton of people, and it would shut down businesses.
- mikeash 13y agoRight. The trick is not to use something that's technically infeasible to block, but to use something that's politically infeasible to block.
- est 13y agoPoliticians doesn't give a shit about your business, if you use porn-enabled SSH, you are a terroist suspect and a threat to childrens of the nation.
- lmm 13y agoAny protocol that runs over SSL on port 443?
- mateuszf 13y agoUsing sslh one can actually host both https sites and ssh on one port. I used this to hop over a very restrictive firewall in my company, it works great.
- est 13y agoHttps handshake is also clear text. There's was previous attempt to block certain types of SSL cert in the past.
- nly 13y agoAs pointed out by est, you can snoop on SSL certificates passing over the wire and drop connections containing canonical names you don't like, or signed by CAs you don't like. You can also drop and throttle HTTPS connections without effecting genuine use, while completely buggering up P2P and other bulky uses.