Re: Detecting SSH tunnels on a linux firewall

2007-01-12 Thread Roberto Mello
On Fri, Jan 12, 2007 at 01:03:38PM -0700, Troy Bowman wrote: > > $ ssh -N -f -D 1080 remotehost > > And, bam! I have a socks5 proxy tunnel from your localhost to the > remotehost. Any application that can use socks5 (firefox, xchat, gaim, > etc) can now use the tunnel to connect to anything thro

Re: Detecting SSH tunnels on a linux firewall

2007-01-12 Thread Chris Carey
On 1/12/07, Matthew Walker <[EMAIL PROTECTED]> wrote: Any idea on how to do this from Windows? I don't have the choice at work, unfortunately, because of VPN software requirements. Install cygwin and make sure to select the openssh package during install /* PLUG: http://plug.org, #utah on irc

Re: Detecting SSH tunnels on a linux firewall

2007-01-12 Thread Matthew Walker
On Fri, January 12, 2007 1:09 pm, Matthew Walker wrote: > > On Fri, January 12, 2007 1:06 pm, Matthew Walker wrote: >> >> On Fri, January 12, 2007 1:03 pm, Troy Bowman wrote: >>> Actually, you don't even need squid on the other end. All you need is >>> to make ssh use its DynamicForward: >>> >>>

Re: Detecting SSH tunnels on a linux firewall

2007-01-12 Thread Matthew Walker
On Fri, January 12, 2007 1:06 pm, Matthew Walker wrote: > > On Fri, January 12, 2007 1:03 pm, Troy Bowman wrote: >> On Wed, 2007-01-10 at 10:24 -0700, Matthew Walker wrote: >> >>> Won't work. I can use Putty to create an SSH tunnel to a server I >>> control >>> running Squid, and direct my local b

Re: Detecting SSH tunnels on a linux firewall

2007-01-12 Thread Matthew Walker
On Fri, January 12, 2007 1:03 pm, Troy Bowman wrote: > On Wed, 2007-01-10 at 10:24 -0700, Matthew Walker wrote: > >> Won't work. I can use Putty to create an SSH tunnel to a server I >> control >> running Squid, and direct my local browser to use the localhost port as >> proxy. > > Actually, you d

Re: Detecting SSH tunnels on a linux firewall

2007-01-12 Thread Troy Bowman
On Wed, 2007-01-10 at 10:24 -0700, Matthew Walker wrote: > Won't work. I can use Putty to create an SSH tunnel to a server I control > running Squid, and direct my local browser to use the localhost port as > proxy. Actually, you don't even need squid on the other end. All you need is to make ss

Re: Detecting SSH tunnels on a linux firewall

2007-01-10 Thread Shane Hathaway
Gabriel Gunderson wrote: On Wed, 2007-01-10 at 10:47 -0700, Dave Long wrote: This situation where the user is ssh'ing to an outside box (from inside the network) to a box presumably with squid is what I am trying to determine. I do not want to be an evil admin and block all ssh access. Sounds

Re: Detecting SSH tunnels on a linux firewall

2007-01-10 Thread Gabriel Gunderson
On Wed, 2007-01-10 at 10:47 -0700, Dave Long wrote: > This situation where the user is ssh'ing to an outside box (from > inside the network) to a box presumably with squid is what I am trying > to determine. I do not want to be an evil admin and block all ssh > access. Sounds like the bigger prob

Re: Detecting SSH tunnels on a linux firewall

2007-01-10 Thread Matthew Walker
On Wed, January 10, 2007 10:47 am, Dave Long wrote: > This situation where the user is ssh'ing to an outside box (from > inside the network) to a box presumably with squid is what I am trying > to determine. I do not want to be an evil admin and block all ssh > access. > Barring statistical anal

Re: Detecting SSH tunnels on a linux firewall

2007-01-10 Thread Dave Long
On 1/10/07, Matthew Walker <[EMAIL PROTECTED]> wrote: On Wed, January 10, 2007 10:15 am, Kyle Robinson wrote: > > Force the HTTP traffic into a transparent proxy. > Won't work. I can use Putty to create an SSH tunnel to a server I control running Squid, and direct my local browser to use the lo

Re: Detecting SSH tunnels on a linux firewall

2007-01-10 Thread Corey Edwards
On Wed, 2007-01-10 at 10:11 -0700, Dave Long wrote: > Is it possible to detect SSH tunnels traveling through a Linux > firewall (iptables). In other words, how do I detect normal ssh > communication versus http traffic going through SSH? > > My initial thoughts were that normal SSH traffic would

Re: Detecting SSH tunnels on a linux firewall

2007-01-10 Thread Matthew Walker
On Wed, January 10, 2007 10:15 am, Kyle Robinson wrote: > > Force the HTTP traffic into a transparent proxy. > Won't work. I can use Putty to create an SSH tunnel to a server I control running Squid, and direct my local browser to use the localhost port as proxy. This routes the entire request th

Re: Detecting SSH tunnels on a linux firewall

2007-01-10 Thread Kyle Robinson
On 1/10/07, Dave Long <[EMAIL PROTECTED]> wrote: Is it possible to detect SSH tunnels traveling through a Linux firewall (iptables). In other words, how do I detect normal ssh communication versus http traffic going through SSH? My initial thoughts were that normal SSH traffic would have a spe

Re: Detecting SSH tunnels on a linux firewall

2007-01-10 Thread Nicholas Leippe
On Wednesday 10 January 2007 10:11, Dave Long wrote: > Is it possible to detect SSH tunnels traveling through a Linux > firewall (iptables). In other words, how do I detect normal ssh > communication versus http traffic going through SSH? > > My initial thoughts were that normal SSH traffic would

Re: Detecting SSH tunnels on a linux firewall

2007-01-10 Thread Matthew Walker
On Wed, January 10, 2007 10:11 am, Dave Long wrote: > Is it possible to detect SSH tunnels traveling through a Linux > firewall (iptables). In other words, how do I detect normal ssh > communication versus http traffic going through SSH? > > My initial thoughts were that normal SSH traffic would

Detecting SSH tunnels on a linux firewall

2007-01-10 Thread Dave Long
Is it possible to detect SSH tunnels traveling through a Linux firewall (iptables). In other words, how do I detect normal ssh communication versus http traffic going through SSH? My initial thoughts were that normal SSH traffic would have a specific connection and packet rate while other traffi