Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Free book to master SSH tunneling concepts

github.com

Post reply on HN
Print view View original

21–28 of 28 posts

Re: Free book to master SSH tunneling concepts

#21

Post by znpy »

crims0n wrote: post #18
Spooky23 wrote: post #14

Earlier quoted context omitted.

It’s pretty much impossible to validate that you are meeting the terms of your contract re: security policy if you’re doing that. You almost certainly were if you were providing SOC services to a big telco. I have terminated contracts for cause and in one case got a vendor suspended from a big centralized procurement contract for pulling bullshit like what you described.

The telco was providing the managed services in this case. That is interesting, so it sounds like this was a complete breakdown in the process somewhere. We weren’t doing it for fun or sport, we were doing it because it was the only way to effectively do our job.

I've been there but nowadays my policy is to let my employer/customer get hit with downtime if they don't provide me with ways to effectively do my work.

Re: Free book to master SSH tunneling concepts

#22

Post by znpy »

bryanrasmussen wrote: post #16
Spooky23 wrote: post #14

Earlier quoted context omitted.

It’s pretty much impossible to validate that you are meeting the terms of your contract re: security policy if you’re doing that. You almost certainly were if you were providing SOC services to a big telco. I have terminated contracts for cause and in one case got a vendor suspended from a big centralized procurement contract for pulling bullshit like what you described.

>You almost certainly were if Don't you mean they almost certainly weren't? It's hard to understand the rest otherwise.

No, gp is speaking from the point of view of those who set up the security measure.

Once you start poking holes into the security it's hard to assure you only did it for a good cause or with good intentions (whatever that means).

Re: Free book to master SSH tunneling concepts

#23

Post by icedchai »

Spooky23 wrote: post #14
crims0n wrote: post #2

Looks interesting, will give it a read as it looks to cover more than the basics. Years ago I worked in a SOC doing managed services for a major telco provider, and for some reason they thought that we didn't have the need to do any kind of SSH tunneling to manage routers/switches/firewalls. They kept blocking it at various layers, and we kept having to find more and more creative ways to get around it. I think at on…

It’s pretty much impossible to validate that you are meeting the terms of your contract re: security policy if you’re doing that. You almost certainly were if you were providing SOC services to a big telco. I have terminated contracts for cause and in one case got a vendor suspended from a big centralized procurement contract for pulling bullshit like what you described.

Folks do all sorts of naughty things with SSH. Back when we used to work in an office, one guy would tunnel out and proxy all his web connections through an SSH socks proxy so the employer's IT would not monitor his web traffic. Another guy would do reverse tunnels from his work PC to home, so he could connect to work without using the VPN.

Re: Free book to master SSH tunneling concepts

#24

Post by anderspitman »

I used local forwarding for years before learning about remote forwarding, which is useful for creating your own self-hosted ngrok-like service. A good number of the solutions on this list are based on SSH remote forwarding:

https://github.com/anderspitman/awesome-tunneling

Re: Free book to master SSH tunneling concepts

#25

Post by Spooky23 »

crims0n wrote: post #18
Spooky23 wrote: post #14

Earlier quoted context omitted.

It’s pretty much impossible to validate that you are meeting the terms of your contract re: security policy if you’re doing that. You almost certainly were if you were providing SOC services to a big telco. I have terminated contracts for cause and in one case got a vendor suspended from a big centralized procurement contract for pulling bullshit like what you described.

The telco was providing the managed services in this case. That is interesting, so it sounds like this was a complete breakdown in the process somewhere. We weren’t doing it for fun or sport, we were doing it because it was the only way to effectively do our job.

Absolutely — that’s nuts! I was in the managed services biz for some time, I can’t imagine facing our auditors having allowed third party contractors to do stuff like that.

Re: Free book to master SSH tunneling concepts

#28

Post by bryanrasmussen »

znpy wrote: post #22
bryanrasmussen wrote: post #16

Earlier quoted context omitted.

>You almost certainly were if Don't you mean they almost certainly weren't? It's hard to understand the rest otherwise.

No, gp is speaking from the point of view of those who set up the security measure. Once you start poking holes into the security it's hard to assure you only did it for a good cause or with good intentions (whatever that means).

I still don't get it:

The original:

"It’s pretty much impossible to validate that you are meeting the terms of your contract re: security policy if you’re doing that. You almost certainly were if you were providing SOC services to a big telco."

That second sentence seems to be only interpretable as:

You almost certainly were meeting the terms of your contract re: security policy if you were providing SOC services to a big telco.

However it also says it's impossible to validate - so if it is impossible to validate that you were meeting the terms of your contract re: security policy, it must mean you weren't meeting the terms of your contract because such a contract will require validation.

But I guess I should let it go.

Post reply on HN