Free book to master SSH tunneling concepts(github.com) |
Free book to master SSH tunneling concepts(github.com) |
Years ago I worked in a SOC doing managed services for a major telco provider, and for some reason they thought that we didn't have the need to do any kind of SSH tunneling to manage routers/switches/firewalls. They kept blocking it at various layers, and we kept having to find more and more creative ways to get around it. I think at one point we were hosting our own PAC files local to our machines, building three layers of tunnels (the last of which being a dynamic SOCKS tunnel), and using a portable browser (because we couldn't be trusted with admin!) with FoxyProxy (or similar) to finally reach our destination.
I have terminated contracts for cause and in one case got a vendor suspended from a big centralized procurement contract for pulling bullshit like what you described.
Don't you mean they almost certainly weren't? It's hard to understand the rest otherwise.
This book does discuss autossh [1] which I came to know about recently while setting up my dynamic home ip (w/ CG-NAT) as the exit node in a wireguard network to overcome geo-restrictions on streaming services when traveling... :p
autossh [1] is such a simple and useful utility, wish I had known about it earlier when any connection changes in VPN/WiFi used to break my ssh tunnels to the corporate network during development...
If you're a frequent user of ssh tunnels, do check out autossh... ;)
No need to install an extra package. No idea whether it is maintained or not, but I know systemd is, both upstream and in the distro.
Thanks, there will be multiple ways to do same thing, user can choose whichever they find the easiest...
Adding an example of such systemd file - https://gist.github.com/drmalex07/c0f9304deea566842490
> No need to install an extra package. No idea whether it is maintained or not, but I know systemd is, both upstream and in the distro.
Definitely not updated with the same frequency as systemd... https://salsa.debian.org/debian/autossh
... although for the later purpose it's no where near as CPU efficient as wiregaurd, but with non root access to any SSH server it can get you around barriers in a pinch with only TCP 443 available, and effectively "VPN" multiple potentially conflicting subnets at the same time - I've not seen any other tool that can do the latter so effortlessly.
Once you start poking holes into the security it's hard to assure you only did it for a good cause or with good intentions (whatever that means).
The original:
"It’s pretty much impossible to validate that you are meeting the terms of your contract re: security policy if you’re doing that. You almost certainly were if you were providing SOC services to a big telco."
That second sentence seems to be only interpretable as:
You almost certainly were meeting the terms of your contract re: security policy if you were providing SOC services to a big telco.
However it also says it's impossible to validate - so if it is impossible to validate that you were meeting the terms of your contract re: security policy, it must mean you weren't meeting the terms of your contract because such a contract will require validation.
But I guess I should let it go.