Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Before I ask my question I would like to point out I am a web developer who normally uses Stack Overflow and new to Sever Fault, I think this is best place for this question.

I have recently started a new job, and among other things my IT department are reluctant to allow Putty access to the internet.

I am confident that there is a genuine reason for this and am just interested to know their reasons. I can imagine allowing any program access on any port access to the internet could be a security threat, but is there any particular reason Putty could be dangerous.

Thanks in advance.

share|improve this question
    
2  
Hi, they're not blocking "Putty", that's an application to access SSH, which is what they actually are blocking. This has been discussed before - see link in other comment. –  RobM Feb 4 '11 at 19:20
    
Slightly disappointed to have my question closed, but reading up about port 22/tcp i can see that other question answers what im looking for. Is there somewhere for non sys admins like me to get advise like this? Thanks to all that answered. –  Alan Whitelaw Feb 4 '11 at 19:52
    
Dont think you cant ask that question here, its a valid question if phrased properly. You just need to ask the question from the perspective of a system administrator for it to qualify here. ie "I'm being requested by my clients to block outbound port 22. Is there any reason for this?" Your question would have still been closed more than likely as its basically a dupe of another question, but you get the idea. –  ErnieTheGeek Feb 4 '11 at 21:05
add comment

closed as off topic by RobM, Zoredache, Ben Pilbrow, Zypher Feb 4 '11 at 19:33

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers

up vote 2 down vote accepted

I don't suspect it's PuTTY itself they are against, but the necessity to open a port on the firewall. Personally, we have a handful of users who need to use PuTTY to manage internal machines, and they are free to do that. If however they asked me to open the SSH port on the firewall, like your IT department I would be much more wary.

Have you actually asked them why? There's no need to be aggressive or confrontational, but a sensible "I appreciate your reluctance - could you please elaborate on your concerns, and can we chat about potential ways to mitigate the potential threat" (or words to that effect). You may be able to come to a compromise such that SSH is opened on the firewall, but only to certain explicitly defined external hosts.

share|improve this answer
    
I will be asking on Monday, but as a web developer and not a server administrator I wanted to make sure I had all the facts! Thanks for your answer, and advise. Thanks –  Alan Whitelaw Feb 4 '11 at 19:48
add comment

reasons are probably as simple as this: is there any business justification for your ssh access to external servers? you can use it [via ssh tunneling] to circumvent whatever corporate internet access policies / screening they have in place [and might be obliged to have in place by some specific regulations].

side note: i'm quite glad that i don't have to work in such environment and do not have to apply such policies on our users.

share|improve this answer
    
This might well be the reason, as there is a lot of non technical staff so the need for restrictions is required. As I mentioned in my question, I am a web developer, so have genuine need to access servers, and was looking for arguments to put forward my case. Thanks –  Alan Whitelaw Feb 4 '11 at 19:45
add comment

Well, using putty you are able to set up an encrypted tunnel to an outside host. This makes you immune to any kind of traffic inspection tools since you can set up a HTTP/HTTPS or Socks proxy on this outside host and break every corporate restriction using this proxy. But disabling Putty (actually 22/tcp traffic) seems to be a kind of security by obscurity. You can always set up an outside SSH server using a legitimate port, say 80/tcp or 443/tcp or even 53/udp.

share|improve this answer
    
Calling it "security by obscurity" is a little unfair. It's good common practice to close all ports you have no business need for and make open ones the exception. It's bad practice to do things the other way around and then go ahead and block SSH because they've heard scary things about it, sure, but we lack the information to judge them on this. –  RobM Feb 4 '11 at 19:34
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.