openssh unix dev - Apr 2023 - It would be nice if OpenSSH would have features to circumvent network filters, like SSL tunneling

I am in the network that is behind the Zscaler firewall.

Virtually all ports except 80 and 443 are closed. ssh through any of 
ports 80 and 443 is disallowed based on protocol content analysis.


It would be nice if OpenSSH would have some features that would allow 
the user to break out of such network.


I suggest that OpenSSH adds the SSL tunneling feature:

1. The server would have the AllowHttpsTunnels {secret token} setting

2. The client would have the -h {secret token} argument that would tell 
it to try the SSL connection when the SSH connection fails, and the -H 
{secret token} argument that would instruct the client to only use the 
SSL tunnel.

3. In case when SSL tunneling is used the client would establish the SSL 
connection, and then it would authenticate the secret token.


The secret token is needed to ensure that deep filters like Zscaler 
wouldn't be able to ban such SSL tunnel based on content probing.


SSL might need to have the HTTP protocol embedded into it (making it an 
HTTPS tunnel) in case the network filter would probe for it and ban 
connections based on its absence.


It is probably possible to do something similar using stunnel but (1) it 
is a lot more difficult to set up and (2) it would be blockable based on 
content probing because no secret token would be involved.


Without such feature more and more users would be unable to use ssh in 
more and more situations.



Yuri

On Wed, 19 Apr 2023, Yuri wrote:
> I am in the network that is behind the Zscaler firewall.
> 
> Virtually all ports except 80 and 443 are closed. ssh through any of ports
80
> and 443 is disallowed based on protocol content analysis.
> 
> 
> It would be nice if OpenSSH would have some features that would allow the
user
> to break out of such network.
You can do everything you need with a ProxyCommand. A good reason *not*
to put such functionality into OpenSSH itself it that firewall vendors
would add a detection for it explicitly and then you're back to square
one, and we're stuck maintaining it.

-d

On Thu, 20 Apr 2023 at 12:04, Yuri <yuri at rawbw.com> wrote:
[...]
> I suggest that OpenSSH adds the SSL tunneling feature:
I don't think this is something we would be interested in doing.

1) it's a pretty niche feature.
2) it would require adding a dependency on OpenSSL's libssl which we
currently do not have.
3) as you note, there are already ways to do this kind of thing via
inetd/proxycommand and/or stunnel.
4) I don't think we'd want to play whack-a-mole with the middlebox
vendors anyway.

If I was trying to do this I'd probably start with stunnel and look at
adding the feature you want to that.

--
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

On Wed, 2023-04-19 at 19:00 -0700, Yuri wrote:
> I am in the network that is behind the Zscaler firewall.
> 
> Virtually all ports except 80 and 443 are closed. ssh through any of 
> ports 80 and 443 is disallowed based on protocol content analysis.
> 
> 
> It would be nice if OpenSSH would have some features that would allow 
> the user to break out of such network.
> 
> 
> I suggest that OpenSSH adds the SSL tunneling feature:
Simply set up stunnel4 according to your needs.
This way you can wrap ssh in ssl.

Yours faithfully,
Bj?rn L?ssig

Here is how I solved this problem:

1. I've built proxytunnel on Windows in Cygwin

2. proxytunnel failed due to an apparent bug with the 
SSL_set_tlsext_host_name invocation, so it had to be commented out, 
after which proxytunnel worked

3. I've configured proxytunnelin c:\Users\{user_name}\.ssh\config 
according to instructions in the GitHub README (ssl had to be enabled, 
SSL key check had to be disabled)

4. I've added the http_proxy_connect option to the FreeBSD port 
www/nginx that adds the ngx_http_proxy_connect third-party nginx module, 
and installed the package with this option enabled

5. I've configured http_proxy_connect according to its GitHub README, 
generated self-signed ssl keys, etc.

6. I added another, un-obvious port that the ssh server listens on, for 
this purpose.


After this ssh works through the https tunnel.


There are a lot of steps. I think that this makes this method 
inaccessible to most regular users so they would really be locked out of 
ssh due to the middlebox filtering.


Hopefully these instructions will help someone.



Best,

Yuri