Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote 0 down vote favorite
1

I believe that my Chinese ISP has started detecting and bandwidth-limiting SSH connections. I'm not using the default SSH port so I suspect that they are using deep packet filtering to detect the unencrypted handshake.

I am aware of one solution to this which patches openSSH to encrypt the handshake. However, I have two problems:

  1. This project is three years old so if I were to just compile it as is, I would be forsaking three years of security updates for openSSH.
  2. My server is in the US and my only way of accessing it is through SSH--so downtime or messing up isn't an option.

As such I have two questions:

  1. Can I somehow patch a current version of openSSH to use the obfuscated handshake? If so, how would I do this? Which files would I need to add/modify in the source?
  2. How could I avoid any downtime for the ssh server while doing this patch? Can I install two ssh servers side by side?

If anyone could help me with this--or knew of a better way to obfuscate ssh handshakes--my appreciation would be boundless!

share|improve this question
   
How about running multiple sshd instances? One to experiment on, and one to keep as a fallback? I would probably just the init script for the safe/fallback version, and just start the experiential version manually. – andol May 30 '12 at 15:27
@andol that was my initial thought, but it sounds like two sshd instances would not play nice with eachother. The answer second part of Lord of Time's answer indicates that this shouldn't be necessary either. I just need to patch it, package it, and install from a ppa. – adempewolff May 30 '12 at 15:40
@andol they won't play nice. You can't have two instances of sshd running simultaneously, at least not safely. – The Lord of Time May 31 '12 at 17:05
@LordofTime Problem being? – andol May 31 '12 at 20:05

2 Answers

up vote 4 down vote

You can use Obfsproxy to to beat DPI, here's a screenshot explaining what it does:

Screenshot shamelessly taken from the TorProject site

share|improve this answer
up vote 1 down vote

1 Can I somehow patch a current version of openSSH to use the obfuscated handshake? If so, how would I do this? Which files would I need to add/modify in the source?

This might be possible, but given the age of the patch, it may take time to apply. Reading the diffs can help to explain what got edited and where, but given development of software over three years, the patch may need manually applied.

2 How could I avoid any downtime for the ssh server while doing this patch? Can I install two ssh servers side by side?

This downtime is negligible. Part of the sshd server update procedure is to turn itself off and turn itself back on when you install with a Debian package. If you patch the source in the package itself, then upload that updated package (and increase the version accordingly) to a PPA, then add that PPA to your sources, and apt-get update and apt-get upgrade, there won't be any real downtime issues.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.