From: Asheesh Laroia <asheesh@asheesh.org>
Date: Mon, 15 Dec 2008 05:24:31 GMT
Subject: Re: is gitosis secure?
Message-ID: <alpine.DEB.2.00.0812142121090.9552@vellum.laroia.net>
In-Reply-To: <87prju5m6s.fsf@hades.wkstn.nix>

On Mon, 15 Dec 2008, Nix wrote:

> On 14 Dec 2008, Jakub Narebski spake thusly:
>> BTW. is outgoing SSH transport (from network to outside) blocked as 
>> well?
>
> *No* ports are open. All they have is a (non-transparent) buggy HTTP 
> proxy. These guys really don't get the Internet, despite their sales 
> literature banging on endlessly about it.

If that's the only way you can access the network, you can take advantage 
of the way HTTP proxies deal with HTTPS: they typically let it through 
byte for byte.

"connect.c is the simple relaying command to make network connection via 
SOCKS and https proxy. It is mainly intended to be used as proxy command 
of OpenSSH."

Run sshd on port 443, use connect.c, and you're set.

(Except for some really smart SSL-aware HTTP proxies that verify that it's 
an SSL connection of some kind.  In theory, you could then sslwrap your 
sshd and then be set.)

-- Asheesh.

-- 
Q:	Why did the astrophysicist order three hamburgers?
A:	Because he was hungry.