On Tue, Sep 17, 2013 at 7:11 AM, Nico Kadel-Garcia <nkadel_at_gmail.com> wrote:
>>>
>> There is always the trick of ssh-ing a command from inside the
>> firewall to the DMZ box that (a) sets up port-forwarding and (b) runs
>> the svn command as though the repo is on localhost. Technically, and
>> from the firewall's point of view, the connection is established
>> outbound.
>
>
> This is also a firing offense in many environments.
Yes, I can understand institutions and security policies that blindly
outlaw tunnels, but note that in this case it goes the 'right'
direction.- that is the control and connection comes from the 'more
secure' side and the tunnel is just because the program that needs to
run won't make its own connection in the direction you need.
> I once had a chief
> developer, with various root SSH key access, running just such tunnels to
> and from his home machine, tunnels that I happened to notice. He was also
> using non-passphrase protected SSH keys, and had *built* the previous
> version of Subversion in use at that company. Given the secure data he had
> access to this way, from offsite, it caused a serous scandal behind closed
> doors, (And I replaced that Subversion with a source controlled one, owned
> by "root", instead of the one owned by him individually!)
First, it is kind of foolish to assume that anyone with an
unrestricted ssh login doesn't have complete access to all the data
that account can read (or reach from either side of the connection),
but also note that this is the opposite case, where the connection
origin and tunnel destination are on the 'less secure' side and the
controlling keys are also outside.
--
Les Mikesell
lesmikesell_at_gmail.com
Received on 2013-09-17 17:15:46 CEST