| ▲ | otterley 8 hours ago |
| Not needing a different port. Middleboxes sometimes block ssh on nonstandard ports. Also, to preserve the alignment between the SSH hostname and the web service hostname, as though the user was accessing a single host at a single public address. Usability is key for them. |
|
| ▲ | Dylan16807 8 hours ago | parent | next [-] |
| Why would anyone configure it to do that? Like, I understand the really restrictive ones that only allow web browsing. But why allow outgoing ssh to port 22 but not other ports? Especially when port 22 is arguably the least secure option. At that point let people connect to any port except for a small blacklist. |
| |
| ▲ | josephcsible 7 hours ago | parent | next [-] | | Middlebox operators aren't known for making reasonable or logical decisions. | |
| ▲ | 9dev 7 hours ago | parent | prev | next [-] | | Asking back, when I limit the outgoing connections from a network, why would I account for any nonstandard port and make the ruleset unwieldy, just in case someone wanted to do something clever? | | |
| ▲ | Dylan16807 6 hours ago | parent [-] | | A simple ruleset would only block a couple dangerous ports and leave everything else connectable. Whitelisting outgoing destination ports is more complicated and more annoying to deal with for no benefit. The only place you should be whitelisting destination ports is when you're looking at incoming connections. | | |
| ▲ | 9dev 5 hours ago | parent [-] | | I definitely block outgoing ports on all our servers by default; Established connections, HTTP(S), DNS, NTP, plus infra-specific rules. There is really no legitimate reason to connect to anything else. The benefit is defence against exfiltration. |
|
| |
| ▲ | otterley 7 hours ago | parent | prev [-] | | I’m not a network security expert, so I don’t know the threat model. I just know that this is a thing companies do sometimes. |
|
|
| ▲ | Charon77 8 hours ago | parent | prev | next [-] |
| They don't want each vm to have different public IP |
| |
|
| ▲ | gsich 8 hours ago | parent | prev [-] |
| Middleboxes are not relevant in this scenario. |
| |
| ▲ | otterley 8 hours ago | parent [-] | | Uh, why not? Unless your SSH client is on the same network as theirs, there are going to be middleboxes somewhere in the path. |
|
