Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor is a great sysadmin tool (2020)

jamieweb.net

Post reply on HN
Print view View original

91–100 of 125 posts

Re: Tor is a great sysadmin tool (2020)

#91

Post by kej »

fluential wrote: post #61
azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

You will like this one as well “SSL/SSH Multiplexer” http://www.rutschle.net/tech/sslh/

Fixed link: https://www.rutschle.net/tech/sslh/README.html

Note that while this is a handy tool, its use is apparent to anyone observing the connection.

Re: Tor is a great sysadmin tool (2020)

#92

Post by dooglius »

unethical_ban wrote: post #51
azalemeth wrote: post #29

Earlier quoted context omitted.

I tried doing that, and largely succeeded, but the specific area of the university in question will not have a bastion SSH host anywhere on their network. They will not allow SSH access in at all . They will however allow SSH access to other parts of the university, with different people in charge, which explicitly do allow an SSH bastion host to exist (and provide several for that purpose). So, the net result is tha…

To quote Dr. Manhattan, "Without condemning, or condoning, I understand". I am in network security. I have stopped shadow IT, and been a part of it. Your situation seems so ungodly stupid and anathema to the point of IT, that the remaining courses of action should be the following. Thoroughly document via email your attempts at explaining requirements to Netsec, to document in writing their objections, to do your bes…

"What did you accomplish during your time with X research group?"

"Nothing since all our equipment broke, but we documented how it was all IT's fault. You shoulda seen the looks on their faces when we called them out on it to the dean!"

Re: Tor is a great sysadmin tool (2020)

#94

Post by slumdev »

relax88 wrote: post #79
novok wrote: post #45

Earlier quoted context omitted.

IT departments make choices that benefit their own needs and for their own convience, often forgetting that the entire point of their department is to make the rest of the organization more effective. Sadly, it often goes the other way. Shadow IT is a signal that the IT organization is doing things wrong. People use shadow IT because the IT department is not doing it's job properly, serving it's customer base based o…

“Policy made my job slightly harder so because I know better than the netsec team who clearly has or should have unlimited time and resources to help me I will do what I want anyways, and put the organization at risk.” Also known as “how to make the netsec team hate you 101” I agree with you about why shadow IT exists, but most IT departments are spread so thin that expecting them to be super responsive to anything b…

> because I know better than the netsec team

For anyone who's been around the block a few times, there's a good chance this is true.

Most organizations' netsec teams are too busy throwing money at vendors to keep up.

Re: Tor is a great sysadmin tool (2020)

#95

Post by belorn »

ISL wrote: post #20
azalemeth wrote: post #3

In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…

Think from the beginning what will be the end: "I thought your security policy was too overbearing, so I used tor." IT departments make their choices for reasons. The key is to help them understand your use-case, and they'll probably help you through the problem in a way that might limit collateral damage. Source: have seen firewall bypasses (with a pre-shared key) get leveraged as a way to hack an entire university…

The problem in my experience is not that the security policy is too overbearing, but rather that the security policy is too rigid and designed with assumptions that are false. A common policy for example is that port 22 must always be closed. One can use a hardware secured two token authentication over ssh, and still the policy is that the port must be closed and that is that. That the policy allow remote desktop with just a password is completely irrelevant because the policy doesn't forbid that.

I have tried so many times to help people understand security and the purpose of a security policy when it is designed correctly, but it doesn't work. The policy exist so people don't need to think, not to make people understand why it exist and what use-cases should be given exceptions.

Re: Tor is a great sysadmin tool (2020)

#96

Post by derefr »

sillysaurusx wrote: post #90
derefr wrote: post #86

Earlier quoted context omitted.

> If you’re literally dodging the NSA, you need to... Or just make friends with an developing-world advance-fee scammer, and then pay them to have one of their cash mules buy and send you (that is, an empty house somewhere in your city) a laptop.

That's an interesting idea I hadn't considered. But it involves a lot of the same problems: you need to get from where you are to where the laptop is, and back, without popping up on any sensors. There are a lot of sensors. Gait detection + god eye is what convinced me this is probably impossible. In my case, I was using NSA as a threat model for added security against the actual threat (cartels), so I wasn't as para…

> you need to get from where you are to where the laptop is, and back, without popping up on any sensors.

Why? As far as They can tell, you're going to a house you've never been to before with no precedent for why, picking up an unlabelled brown box, and returning home.

The NSA would know you did that — but they wouldn't be able to connect it to a laptop in order to intercept/MITM it into being an insecure device (or to note down its MAC address for when you go online with it), since the "logistics chain" would be one entirely disconnected from you right until the moment you showed up at the house. To bug the laptop, they'd have to literally rip it out of your hands. Until the moment you pull into that house's driveway to pick up the parcel, they don't know it's your laptop (or what it is at all, really) so they don't know they should be trying to intercept it.

(And yes, They would likely have footage showing some other person dropping the unlabelled brown box off in the house's parking lot — but that would be a person who is not flagged as a Person of Interest in any NSA system, but rather some bright-eyed innocent college kid who had started a "new job" to "earn money fast" by "delivering parcels" just the day before. Parcels they pick up and re-box at AirBnB single-day rentals, rented just for the purpose of receiving that one parcel by the money-launderer.)

Replace "laptop" with "box full of dirty money" and this exact thing is done hundreds of times every day, with the NSA being able to do roughly zilch about it. "Cash mule" wouldn't exist as a profession if the transactions they facilitate could just be deanonymized+disintermediated in real time.

Re: Tor is a great sysadmin tool (2020)

#97

Post by gpapilion »

belorn wrote: post #95
ISL wrote: post #20

Earlier quoted context omitted.

Think from the beginning what will be the end: "I thought your security policy was too overbearing, so I used tor." IT departments make their choices for reasons. The key is to help them understand your use-case, and they'll probably help you through the problem in a way that might limit collateral damage. Source: have seen firewall bypasses (with a pre-shared key) get leveraged as a way to hack an entire university…

The problem in my experience is not that the security policy is too overbearing, but rather that the security policy is too rigid and designed with assumptions that are false. A common policy for example is that port 22 must always be closed. One can use a hardware secured two token authentication over ssh, and still the policy is that the port must be closed and that is that. That the policy allow remote desktop wit…

Often times these policies are driven by industry compliance. Exceptions have to be documented, and depend on the compliance regime, may carry liability. Lastly when exceptions are made the user often doesn’t know what they signed up for, and it ends up holding the bag for a breech.

It’s usually better to not make an exception.

Re: Tor is a great sysadmin tool (2020)

#98

Post by njsubedi »

kodablah wrote: post #53
njsubedi wrote: post #49

Earlier quoted context omitted.

Could you share more about your setup?

Sure. I wrote https://github.com/cretz/bine (though I admittedly don't work on it much these days). I just have a few-line daemon that starts an HTTP (or gRPC or whatever) server on ephemeral onion service. Then I use that onion ID to access it (via TorBrowser or Orbot or a client built with the same library).

Thank you!

Re: Tor is a great sysadmin tool (2020)

#99

Post by _carbyau_ »

unethical_ban wrote: post #51
azalemeth wrote: post #29

Earlier quoted context omitted.

I tried doing that, and largely succeeded, but the specific area of the university in question will not have a bastion SSH host anywhere on their network. They will not allow SSH access in at all . They will however allow SSH access to other parts of the university, with different people in charge, which explicitly do allow an SSH bastion host to exist (and provide several for that purpose). So, the net result is tha…

To quote Dr. Manhattan, "Without condemning, or condoning, I understand". I am in network security. I have stopped shadow IT, and been a part of it. Your situation seems so ungodly stupid and anathema to the point of IT, that the remaining courses of action should be the following. Thoroughly document via email your attempts at explaining requirements to Netsec, to document in writing their objections, to do your bes…

This is a diverging motivations issue.

Many people are not in a stable career such that they can hang around and do upper management's job for them by "expensively failing so as to demonstrate IT's failures".

Academics and PHD students in particular live from grant to grant. They can't afford to waste grant money "to make a point that IT doesn't work." Reputations - and by extension careers - can be made and unmade with such stuff.

Aside, I think the academic life being so fragile is ALSO silly but that is another story.

Re: Tor is a great sysadmin tool (2020)

#100

Post by Spivak »

dooglius wrote: post #92
unethical_ban wrote: post #51

Earlier quoted context omitted.

To quote Dr. Manhattan, "Without condemning, or condoning, I understand". I am in network security. I have stopped shadow IT, and been a part of it. Your situation seems so ungodly stupid and anathema to the point of IT, that the remaining courses of action should be the following. Thoroughly document via email your attempts at explaining requirements to Netsec, to document in writing their objections, to do your bes…

"What did you accomplish during your time with X research group?" "Nothing since all our equipment broke, but we documented how it was all IT's fault. You shoulda seen the looks on their faces when we called them out on it to the dean!"

It seems weird to dump on IT when they’re a department responding to the incentive structure they’re placed under like everyone else. You going to the Dean/someone with actual authority to get top down approval for IT to give you what you want is basically how IT operates in large orgs. I have nigh infinite technical power but in return I am bound politically by polities that I’m explicitly not allowed to have any authority over (i.e. I can’t approve my own policy exceptions). I want to give you literally anything you ask for. As long as my ass is covered it literally doesn’t matter at all to me. When I worked Uni IT if someone wanted something we couldn’t give them because $dumb_reason weren’t in a position to have that fight with the higher-ups on their behalf. It doesn’t mean much coming from us and since it’s not impacting our work it falls on deaf ears.

From your tone you make it seem like you were proud to waste everyone’s time and money when one single meeting with the Dean and the CIO/Director of IT when the problem happened would have opened every door for you.

Post reply on HN