Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Most http proxy servers do not allow to send ssl over non 443 ports. Why is this a security risk?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Depends on the reason for it. One possibility is to control the sites that a user visits and the services that a user accesses. This is usually the case in corporate environments.

By default, you cannot monitor content over SSL via the proxy. When a client makes a SSL connection, they use the CONNECT method instead of GET/POST/HEAD and the proxy has to either connect directly or block it. If allowed to connect directly, the session is assumed to be encrypted with SSL.

So, there is little that a proxy server can do in terms of monitoring and control. For example, most corporate proxies can filter sites to see if they are on a black-list and block connections based on information in the HTTP headers. With the CONNECT method, it would not be feasible to do this.

So, if allowed to CONNECT to non 443 ports, the proxy server can be used to access ANY service externally. For example, I could feasibly do a CONNECT to port 22 on an external server and then tunnel SSH traffic over it instead. I could also do a CONNECT to port 6667 and then run an IRC session over it.

No one would be the wiser unless extra effort is put into analysing the traffic flowing over it. Therefore, it is far easier to just restrict the CONNECT method to port 443.

Check out the wikipedia article on HTTP tunneling.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.