Hacker News

points by LeBit 2 days ago | 0 comments

Doing ssh through port 80 or 53 or 443 is immediately flagged.

I understand port 443 is always opened but nowadays you can’t just run ssh traffic on 443 without it being detected as not being https

[–] octoberfranklin 2 days ago

Flagged by who? The Internet Police? This comment is absurd.

[–] novafunc 2 days ago

By restricted networks, like hospitals, workplaces, schools, etc.

If their firewalls can detect it not being typical http/s traffic, they can block it.

[–] QuantumNomad_ 2 days ago

I run WireGuard VPN on port 443 UDP. Many times I can connect to that from various public WiFi networks like coffee shops and public libraries. And then I ssh into my machines at home over my self-hosted VPN.

I’ve been hoping that HTTP3 adoption would make 443 UDP accessible from even more places. But maybe they already do the kind of thing you said for that too, looking at the traffic flow to determine that it is not HTTPS.

Weirdly sometimes there are WiFi networks where I am not able to connect to my WireGuard VPN on 443 UDP, but I can connect to servers over ssh on standard port 22 TCP. Perhaps they sometimes block all UDP traffic because they don’t want people to use BitTorrent etc, but one would think that with all the online meeting platforms that do video streaming there would be a lot of problems for people if all UDP traffic was blanket blocked.

I might eventually try out AmneziaWG instead of vanilla WireGuard, but at the moment I am fine not being able to Connect to my VPN sometimes. I only use it to connect to my other machines anyway, not as a VPN tunnel for my web browsing etc.

[–] teravor 2 days ago

it's possible commercial routers such as the ones utilized by restaurants allow wireguard through these days? wireguard makes no effort to be stealthy when emitting.

some VPN apps bypass wireguard blocks automatically by using https tunnels and whatnot.

[–] Imustaskforhelp 2 days ago

Does mosh help with it? Seems to be based on udp, and it looks good. I am not entirely sure if it helps the issue that you are talking about so hoping for someone more experienced to chime in

https://mosh.org/

[–] rietta 2 days ago

It worked in 2008 - 18 years ago. I have other options now like said cloudflare tunnel.

[–] lmm 1 day ago

A lot of networks still just do dumb port blocking. Yes, any network that is making a serious effort to prevent ssh will succeed. But a lot aren't.

[–] megous 2 days ago

Naive. There's not much that prevents you from running ssh over https. Not even traffic patterns will give you up in the age of ubiquitous websockets and/or http2 streams.

[–] toast0 1 day ago

> Not even traffic patterns will give you up in the age of ubiquitous websockets and/or http2 streams.

SSH is dead simple to detect, because the server sends an outbound greeting in ASCII text; and the client doesn't send anything until it gets the greeting. The binary protocol does not look like a TLS stream at all either.

[–] InsidiousWombat 1 day ago

It will absolutely and trivially be detected by any decent IDS/IPS

SSH does nothing to hide it is SSH (tho "I'm just https" mode would certainly be welcome addition)

[–] sandos 1 day ago

Even with corporate MITM setups? I somehow doubt it..

[–] megous 1 day ago

MITM only works if you allow trust in corporate CA on the outbound HTTPS connections. And why would you?

[–] jon-wood 1 day ago

Its not always the case but many of MITM-ing corporate firewalls are going to immediately drop any TLS connection they can't decrypt on the basis they're coming from an unauthorised device.

[–] LeBit 1 day ago

No need for MITM.

DPI immediately can tell it is ssh.

[–] megous 1 day ago

Yeah, sure. By magic I guess. :)

[–] p_l 1 day ago

No, by DPI. SSH has recognizable signature as does web sockets etc.

Takes flipping one switch for 443 to be made HTTPS + HTTP2 + websocket only by egress firewall if you paid for one with DPI

[–] LeBit 2 days ago

"Naive”. How ironic.

[–] jen20 1 day ago

I think you're likely attributing too much competence to the kind of place that restricts outbound traffic to 80 and 443 in the first place.