Hacker News

points by megous 2 days ago | 0 comments

Naive. There's not much that prevents you from running ssh over https. Not even traffic patterns will give you up in the age of ubiquitous websockets and/or http2 streams.

[–] toast0 1 day ago

> Not even traffic patterns will give you up in the age of ubiquitous websockets and/or http2 streams.

SSH is dead simple to detect, because the server sends an outbound greeting in ASCII text; and the client doesn't send anything until it gets the greeting. The binary protocol does not look like a TLS stream at all either.

[–] InsidiousWombat 1 day ago

It will absolutely and trivially be detected by any decent IDS/IPS

SSH does nothing to hide it is SSH (tho "I'm just https" mode would certainly be welcome addition)

[–] sandos 2 days ago

Even with corporate MITM setups? I somehow doubt it..

[–] megous 1 day ago

MITM only works if you allow trust in corporate CA on the outbound HTTPS connections. And why would you?

[–] jon-wood 1 day ago

Its not always the case but many of MITM-ing corporate firewalls are going to immediately drop any TLS connection they can't decrypt on the basis they're coming from an unauthorised device.

[–] LeBit 1 day ago

No need for MITM.

DPI immediately can tell it is ssh.

[–] megous 1 day ago

Yeah, sure. By magic I guess. :)

[–] p_l 1 day ago

No, by DPI. SSH has recognizable signature as does web sockets etc.

Takes flipping one switch for 443 to be made HTTPS + HTTP2 + websocket only by egress firewall if you paid for one with DPI

[–] LeBit 2 days ago

"Naive”. How ironic.