SSH to server from work's network reddit / selfhosted ---------------------------------------------------------------------- zachatttack96 · 2023-10-13 20:11 I have a server that I keep my personal notes, todo lists on, etc. While I can just access this from my phone, its much easier while using a desktop. I've already briefly tested and I'm able to connect to my server via SSH from my work's PC. We regularly use SSH internally, but my concern is that its could raise a flag to IT if they see an SSH connection going to a random IP (mine). We use OpenVPN to connect to the work network if we're remote, so likely they could trace that the random IP does belong to me. With SSH does all SSH traffic look the same or will IT be able to tell internal vs external connections? ---------------------------------------------------------------------- zoom3579 · 2023-10-13 20:19 I would honestly avoid doing anything personal or moving any data from a work device to another location (a non work owned device). It's the sort of thing that's hard to explain and can lead to trouble down the line. ---------------------------------------------------------------------- ziglotus7772 · 2023-10-13 20:19 This is probably something you want to ask at work about - you'll get a huge variety of answers on here and nobody will no the security policies at your office. If there are any concerns about exfiltration of data and you've been SSHing home without telling anybody, it could mean very bad things for you. Chances are there's already a policy in place, but you truly need to ask. If people have no issue with it, have them put it in writing and save that document/email/whatever. If they say it's not allowed, listen to them if you want to keep your job. ---------------------------------------------------------------------- RickRotHut · 2023-10-13 20:43 Admin here. It's good practice for company firewalls to block outbound connections like unknown VPN locations, SSH to public systems outside the company network. There may also be an IDS/IPS solution in place and a monitoring tool to detect fishy potentially non-compliant activity like that (tunneling SSH over whatever other ports). They usually resolve the clients hostname and there you are. It could get you into serious trouble. In germany a situation like this could cause a write-up. ---------------------------------------------------------------------- nsouthon · 2023-10-13 20:51 The other comments about workplace security are valid, but you could always change the port the SSH demon listens on, maybe port 80 or 443, and that traffic might go un-noticed for longer. ---------------------------------------------------------------------- guptaxpn · 2023-10-13 21:05 It depends on how much you like your job. Honestly it might just be easier/better to just do it on your phone. Your workplace almost certainly has specific computer use policies, and those almost universally say 'don't do this'. This could be considered a security breach. ​ If you're asking on \*this\* forum...just...just don't. ---------------------------------------------------------------------- slyzik · 2023-10-13 22:05 i am glad that in my current job, we have a special jump server which we can use exactly for this purpose, to jump to our personal server. it is good for both sides, as you can connect to your server, and it is still better controlled to avoid DLP. Alternatively you can use some web based ssh. https://developers.cloudflare.com/cloudflare-one/connections/connect- networks/use-cases/ssh/ ---------------------------------------------------------------------- Eldiabolo18 · 2023-10-13 22:33 Are you allowed to use you work equipment for personal stuff? If not, dont do it. ---------------------------------------------------------------------- zachatttack96 · 2023-10-13 23:04 That's definitely the safe/smart route and what I'll end up doing, I just prefer using a desktop over a smart phone. ---------------------------------------------------------------------- Cynyr36 · 2023-10-13 23:27 Even if you are allowed, don't. It'll get messy at some point. Same for using work hardware for personal stuff. The closest this should ever get is insurance and pto. Maybe webmail. ---------------------------------------------------------------------- Tularis1 · 2023-10-13 23:43 I used to run ssh on port 443 for year. Https traffic ? Random encrypted traffic? Might still work. ---------------------------------------------------------------------- dsp_pepsi · 2023-10-14 00:05 Sysadmin here. Don’t do this. Rent a VPS and install a wireguard connection from there back to your home network. Run something like Guacamole to access SSH/RDP/VNC back to your home network from the internet via browser. Protect it with Authelia and Fail2Ban. If IPS detects an outbound SSH connection, especially if it’s tunneled through another port, it could trigger a data exfiltration response. You don’t want to be explaining this to your security officer. There are ways to do what you want without going around your company’s security policies. They exist for good reason. ---------------------------------------------------------------------- _Sheep_Shagger_ · 2023-10-14 00:31 Yes that should raise a flag to any decent IT department. Assuming your company doesn’t have any tracking sw on work pc, and it has both lan and WiFi, a better option would be to use your phone as hotspot, connect work pc to that, and force the ssh connection over the WiFi phone connection, with all other traffic going over lan connection. Still best not to do it at all, but with the above they can’t see that ssh connection. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-14 00:46 I’m confused. You still ssh/RDP/VNC to the VPN. It’s just not your home IP. No change in how it works. ---------------------------------------------------------------------- hudsonreaders · 2023-10-14 01:05 Can you tether your computer to your phone, and use that for your ssh traffic? ---------------------------------------------------------------------- dsp_pepsi · 2023-10-14 01:11 No, you access Guacamole hosted on your VPS. Guacamole provides a web based interface for all those other protocols back to your home devices. As far as you employer can see, you’re just accessing a standard HTTPS website. ---------------------------------------------------------------------- zfa · 2023-10-14 01:30 I'm of a similar opinion - if you absolutely must access home devices then just use something like MeshCentral and do it in a std browser session, much akin to Guac. At least then you're not doing anything 'sneaky' like tunnelling trafic inside other protocols which looks like willful circumvention of policy and applied network restrictions. Can always just claim as you could access it you didn't know it was frowned upon and much more likely to just be told not to do it anymore if the behaviour is questioned. ---------------------------------------------------------------------- gsmitheidw1 · 2023-10-14 03:38 The other way to look at this is do you (as a sysadmin of your home network) trust implicitly your work environment? What if your work network was compromised? A rogue IT staff inside the organisation? Keyloggers? Yea I wouldn't trust anything I didn't have sole access to and have installed myself to be accessing my home network. Keep all that stuff separate. ---------------------------------------------------------------------- _Traveler · 2023-10-14 05:08 This is actually kind of what I do, I run a Firefox container on my free Oracle and then VPN to the rest of my stuffs via tailscale from there. Browser is protected via Oauth/2FA... haven't raised any issues yet, always wondered how detectable/safe this is... ---------------------------------------------------------------------- slyzik · 2023-10-14 05:57 this is trivially easy to detect these days.... it is only because your security admins don't care.. ---------------------------------------------------------------------- jpinbn · 2023-10-14 09:05 By now, I always assume there is a monitoring tool installed on work computers, like vnc and the likes, and someone looks regularly at screenshots from your current session. So I'd never mix private stuff with work. ---------------------------------------------------------------------- porksandwich9113 · 2023-10-14 10:53 Do not mix personal and private networks. ---------------------------------------------------------------------- thefoxman88 · 2023-10-15 09:27 I use kasm (cloudflare/nginx proxy manager with my own domain name) I just spawn my own ssh session to access my own servers at home.