0

I would like to detect the usage of ssh on port 443 on a linux gateway. A kind of counter measure against stuff like sslh. I think netfilter and iptables would be the solution, but can't find module that fits.

(edit) At this time it is not a problem for me to prohibe direct connexion to 443 but allow for example a proxy.

So if it is not possible at L7 filtering, is there a proxy solution that permit this filtering.

  • 4
    Possible duplicate of Is there a way to do layer 7 filtering in Linux? – Rui F Ribeiro Mar 9 at 15:37
  • 1
    It is possible, but nothing that runs in Linux that I know of. There are heuristics, I recall some software using it - no idea about the false positives -, and advanced hardware traffic shapers using heuristics are also a possibility, but they cost a lot of money. – Rui F Ribeiro Mar 9 at 15:47
1

In general, this isn't possible. For it to be possible, it must be the case that either (1) SSH-over-443 is being done naively rather than actually being tunneled over SSL, or (2) you're breaking all SSL connections and have convinced all clients to accept your fake root CA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.