Accessing SSH from higly secure network (not mine) [closed]

Question

A user, who has a company laptop (Windows Vista) and is located in a network that doesn't allow just any traffic to get out, needs to log into one of my SSH servers. It doesn't work. As far as I can gather, security is:

• General port restrictions at the router level; only allow 80, 443, etc.
• Local Software firewall restricting program access (Symantec software)
• HTTP is not proxied.
• He is not a local Administrator on his laptop.

I made an iptables rule that forwards port 80 to 22. When he accesses the host with Internet Explorer, he gets an SSH version string. Putty, however, can't connect. Nor can wget.

I suspect that the Symantec firewall is blocking it. When you open the status panel, you can't see what is allowed and what is not (but you can see the connection each program makes), but I suspect that when one were to access it with Administrator rights, you'd be able to see that, and grant programs access.

To sum up, I tried:

• ssh on port 80
• VPN to the host (is also blocked)
• Naming putty.exe IExplore.exe
• Adding routes to routing table (can't, you need admin rights)

The only solution I see at the moment is installing a web-based ssh client on the server in question...

Answer 1

I would first contact their network admin and explain why the port needs to be opened. As a network admin, if there were a valid reason for someone to need SSH traffic I'd have no problem enabling it and adjusting the firewall rules on their machine to allow whatever traffic was needed.

The reason these things are blocked in the first place is because many places only allow the traffic they need, and block everything else until someone actually needs it. It's much easier to block everything and allow the things you know is good, than to allow everything and try to block the bad stuff. Restrictions like this can for example help prevent viruses from spreading or connecting to it's control servers.

If the network admin can't/won't help you, you can install a web based terminal program on your server. GateOne is a really nice one that has a lot of useful features.

Since that is all regular web traffic it will likely be allowed by both the local machine firewall and the network firewall(s). I have tested it on a very restrictive network at a hotel and had no issues.

TL;DR

Your options are, from best to worst:

• Contact network admin, get them to fix it - if it's for business purposes they will

• Install a web based terminal or SSH client on your server

• Get a cellular internet USB stick and use that instead of the network provided

Answer 2

Another workaround solutions could be sslh, a ssh/ssl multiplexer: it multiplexes (listening on 443) https connections to apache and ssh request to sshd.

Answer 3

I am not sure whether this requires admin privilege but you might use stunnel. That would look to the firewall like https and the local access by putty will hardly be blocked.

Answer 4

maybe firewall also checks type of traffic, and if it see that ssl traffic goes via 80 port it drop connection. Try to up ssh on the port 443, it may help if I am right.