I'm not really sure where or to whom I should ask this question, so hopefully you all can help me.

I am working on a project that I would like to add data to the end of each packet before encryption on an SSH client, then take that data off the packet right after decryption on the SSH target. I'd like to do this with all communication during the ssh session as part of an authentication system I am working on involving SSH

Currently I'm looking at the OpenSSH github and looking beginning to look through the sshd.c file, but I'm hoping someone can point me to the right file to look at to help me achieve this or perhaps a better place to ask this question to reach people who would know more about this stuff.

Any help would be greatly appreciated - Thank you!

  • 4
    It might help if you were to explain a bit more about what it is you need to achieve. Appending packets is what you are presenting as a solution, but what problem is it trying to solve? Maybe there’s another way to reach the same goal. – bxm Nov 20 '19 at 19:16
  • I'm trying to piggyback on ssh to add a byte (or some short amount of data) that the ssh target will pull off and use as part of a passive authentication system. So ideally, if the target receives a packet and the added byte is not what it was expecting, it can shutdown the connection or log that or something. I'd like to use ssh as it's already built into all linux systems and handles encryption, key exchange/management, etc. – Raw Rebuttals Nov 20 '19 at 20:47
  • The project is still in early stages, so I can't be extremely specific. However, I plan to have shared knowledge between clients, of which they use this shared knowledge to append the byte, then each client can passively authenticate each other based on the byte and how it relates to the shared knowledge. Hopefully that makes sense. – Raw Rebuttals Nov 20 '19 at 20:49
  • Maybe I'm missing something (or you have mis-worded your comment) but SSH clients don't talk to each other. SSH is purely client to server. – bxm Nov 20 '19 at 23:01
  • I absolutely don't get you: since you're adding your data before encryption, and are extracting it after encryption, why care about the encryption and ssh at all? Just mandate that your protocol should run over some kind of reliable channel and be done. Just as ssh does itself. Ssh does not care about "packets", and does not encrypt its data packet-wise. It just needs some reliable channel, which is usually tcp, but may be something else (just search for ProxyCommand and sshd -i). In fact, ssh can run atop ssh, which does happen in many reverse-ssh setups. – mosvy Nov 20 '19 at 23:28

An alternative is to leave ssh alone (meaning for example that you can also apply updates and security fixes without recompiling).

You then do your out-of-bound communication with a wrapper, using port forwarding instead. That's already been done, check the -M flag in autossh.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.