Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A user, who has a company laptop (Windows Vista) and is located in a network that doesn't allow just any traffic to get out, needs to log into one of my SSH servers. It doesn't work. As far as I can gather, security is:

  • General port restrictions at the router level; only allow 80, 443, etc.
  • Local Software firewall restricting program access (Symantec software)
  • HTTP is not proxied.
  • He is not a local Administrator on his laptop.

I made an iptables rule that forwards port 80 to 22. When he accesses the host with Internet Explorer, he gets an SSH version string. Putty, however, can't connect. Nor can wget.

I suspect that the Symantec firewall is blocking it. When you open the status panel, you can't see what is allowed and what is not (but you can see the connection each program makes), but I suspect that when one were to access it with Administrator rights, you'd be able to see that, and grant programs access.

To sum up, I tried:

  • ssh on port 80
  • VPN to the host (is also blocked)
  • Naming putty.exe IExplore.exe
  • Adding routes to routing table (can't, you need admin rights)

The only solution I see at the moment is installing a web-based ssh client on the server in question...

share|improve this question

closed as off topic by MDMarra, Dave M, mgorven, mdpc, Ward Feb 15 '13 at 6:09

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

5  
If the client has a valid reason to make this connection to the outside (valid from the point of the company) he should talk to the admin to grant him access. If he hasn't, he shouldn't try. –  Sven Feb 14 '13 at 12:20
    
Server Fault is not about "Unauthorized hacking, password cracking, or system misuse"... –  Deer Hunter Feb 14 '13 at 13:40
    
I understand why this could be seen as "Unauthorized hacking, password cracking, or system misuse", but it really isn't. It's a long story, that I'd rather not go into. Still, if the question needs to be closed, I'll accept it. –  Halfgaar Feb 14 '13 at 19:21

4 Answers 4

I would first contact their network admin and explain why the port needs to be opened. As a network admin, if there were a valid reason for someone to need SSH traffic I'd have no problem enabling it and adjusting the firewall rules on their machine to allow whatever traffic was needed.

The reason these things are blocked in the first place is because many places only allow the traffic they need, and block everything else until someone actually needs it. It's much easier to block everything and allow the things you know is good, than to allow everything and try to block the bad stuff. Restrictions like this can for example help prevent viruses from spreading or connecting to it's control servers.

If the network admin can't/won't help you, you can install a web based terminal program on your server. GateOne is a really nice one that has a lot of useful features.

Since that is all regular web traffic it will likely be allowed by both the local machine firewall and the network firewall(s). I have tested it on a very restrictive network at a hotel and had no issues.

TL;DR

Your options are, from best to worst:

  • Contact network admin, get them to fix it - if it's for business purposes they will

  • Install a web based terminal or SSH client on your server

  • Get a cellular internet USB stick and use that instead of the network provided

share|improve this answer
    
+1 on the cellular modem., Actually, +1 on all other options as well. Anything that is highly secure is secured for a reason (yes, paranoia is one of such reasons). As an extra item, he can use his own device... –  Deer Hunter Feb 14 '13 at 13:38

I am not sure whether this requires admin privilege but you might use stunnel. That would look to the firewall like https and the local access by putty will hardly be blocked.

share|improve this answer

Another workaround solutions could be sslh, a ssh/ssl multiplexer: it multiplexes (listening on 443) https connections to apache and ssh request to sshd.

share|improve this answer

maybe firewall also checks type of traffic, and if it see that ssl traffic goes via 80 port it drop connection. Try to up ssh on the port 443, it may help if I am right.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.