Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm working for an important company which has some severe network policies. I'd like to connect from my work, to my home linux server (mainly because it allows me to monitor my home-automated installation, but that's off-topic) but of course, any ssh connection (tcp port 22) to an external site is blocked. While I understand why this is done (to avoid ssh tunnels I guess), I really need to have some access to my box.

(Well, "need" might be exagerated, but that would be nice ;)

Do you know any web-based solution that I could install on my home linux server that would give me some pseudo-terminal (served using https) embedded in a web page ? I'm not necessarily looking for something graphical: a simple web-embedded ssh console would do the trick.

Or do you guys see any other solution that wouldn't compromise network security ?

Thank you very much for your solutions/advices.

EDIT:

Any solution able to work within apache2 would be even more adequate.

share|improve this question

6 Answers 6

up vote 2 down vote accepted

Something like ajaxterm ?

You could also create a SSH tunnel over HTTP but your network admin probably doesn't want you to do that and it's overkill.

share|improve this answer
    
Yes ! ajaxterm seems to be the one. Thank you very much ! –  ereOn Mar 31 '10 at 9:19

Maybe: http://www.javassh.org ?

share|improve this answer
    
Thank you, i will take a look. –  ereOn Mar 31 '10 at 9:17

If they've got some severe policies then it's likely they have some serious sanctions (like firing you) for transgressions. Ensure that you have got written permission to be monitoring your home on their time and using their equipment. Connect at your own expense using your own resources like a 3G card on a laptop or a smartphone is a better solution.

share|improve this answer
    
Yep, I thought of that. I've heard of some people here that setup icmp tunnels but I don't like it. I understand why those restrictions exists and that's why I don't want a direct link to be established between my work computer and my home. From my point of view, using a web-based solution is safer and more likely to be tolerated. Anyway, thank you for your advices. –  ereOn Mar 31 '10 at 9:23
    
I have logged into my home setup with my iPhone. Typing is a pain, so I have short aliases for everything I usually type. By doing that, I avoid all company equipment. Does your job allow you iPhones or the equivalent? –  David Thornley Mar 31 '10 at 20:19
    
Yep it does. Unfortunately I signed for 2 years with my current phone operator and can't change for the time being. –  ereOn Apr 1 '10 at 8:32

If you're that concerned than I would suggest getting a mobile that's capable of running a terminal. iPhone + TouchTerm / TouchTerm Pro is my solution. I'm sure the same could be accomplished with an Android phone as well although I don't have any experience with that. This solution would also allow you to monitor your home installation from anywhere and not just work.

share|improve this answer
    
Well, unless the company forbids the use of personal phones ;) But for sure, yes: that is a nice solution in many (other) cases. Thanks. –  ereOn Mar 31 '10 at 12:27

If you're trying to get around silly firewall rules, it's a direct link between computers whether it's over port 22 or port 443. The only significant difference is which port it's on. If you want to get REALLY sneaky, try DNS tunnelling.

share|improve this answer

Change the port of your ssh server to 443.

share|improve this answer
    
Thank you very much. Unfortunately, my 443 TCP port is used by apache (and I can't go without it). But I just wonder, is there a way for a network administrator watching at the network traffic, to distinguish between a ssh on TCP/443 connection and a legitimate HTTPS connection ? –  ereOn Mar 31 '10 at 9:12
    
I havent got deep knowledge on the tcp stack, but they shouldn't be able to, as both are encrypted. –  Iraklis Mar 31 '10 at 9:20
2  
They can. The first thing an SSH server does is send it's version string in cleartext, any basic Network IDS will redflag a SSH id string on a non-ssh port. –  Jason Mar 31 '10 at 11:05
    
Many thanks for your comment. It's good to know. –  ereOn Mar 31 '10 at 12:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.