|
|
Subscribe / Log in / New account

Ryabitsev: Travel (Linux) laptop setup

On his blog, Linux Foundation Director of IT Infrastructure Security Konstantin Ryabitsev has some advice for laptop security when traveling overseas. Some attendees of LinuxCon China in Beijing June 19-20 have asked for his thoughts, so he put together the post, which is good advice, if perhaps overly paranoid for some, no matter what country you might be visiting. "China is not signatory to the "Personal Use Exemption" when it comes to encrypted devices, so bringing a laptop with encrypted hard drive with you is not technically legal. If the border officer does not like you for some reason and has grounds to suspect you are not being truthful about your stated reasons for entering China, you may be asked to decrypt your devices for a search. Failure to do so may result in unpleasantness, and you may be detained or fined merely on the grounds of having an encrypted device when entering the country. (As opposed to, for example, entering a country that is signatory to the personal use exemption, where just having an encrypted device is not grounds for any action. That said, it is never in your interest to make the border officer not like you for some reason. Until you are admitted to the country as a legal alien, the Geneva Convention and the Universal Declaration of Human Rights are pretty much the only legal frameworks protecting you as a person against foreign government action.) It is important to point out that you are extremely unlikely to be penalized for bringing in an encrypted laptop with you to China, as any kind of widespread zealous application of such practice would quickly shut down any business travel to China -- and this is definitely not in the government's interest."

to post comments

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 16, 2017 19:32 UTC (Fri) by zlynx (guest, #2285) [Link] (2 responses)

The encryption rules in several countries are super silly.

If taken literally, the AES encryption used by nearly every SSD would qualify. If you ever did a Secure Erase, the drive would be full of encrypted files that you can't access.

If your SSD had reserved, unpartitioned space, as is common for improving drive lifetime (see Samsung EVO recommendations) how could you ever prove that wasn't a hidden encrypted drive?

Silly.

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 17, 2017 4:09 UTC (Sat) by biergaizi (subscriber, #92498) [Link] (1 responses)

As a citizen in China, I did my own research a few years ago, looked for laws and regulations of cryptography.

A cryptographic device can be basically categorized as "Military/Governmental" and "Commercial", so any cryptographic devices for personal use falls info the "commerical" category. And here's the regulatory requirements for Commercial Cryptographic Devices.

---------------------

My rough translation:

COMMERCIAL CRYPTOGRAPHY REGULATIONS
by Office of the State Commercial Cryptography Administration

Department of the State, People's Republic of China, Executive Order #273.
1999

Article 7: Commercial Cryptographic Products shall be produced by specified national cryptography administration. Any individual or entity shall not produce Commercial Cryptographic Products.

Article 10: Commercial Cryptographic Products shall be sold by authorized national cryptography administration, if unauthorized, any individual or entity shall not sell Commercial Cryptographic Products.

Article 13: Importing cryptography products or devices with cryptographic technology, or exporting Commercial Cryptographic Products, must be registered and approved by national cryptography administration. Any entity or individual shall not sell foreign cryptography products.

Article 14: Any individual or entity shall only use Commercial Cryptographic Products authorized by national cryptography administration, shall not use self-developed or foreign-produced Cryptographic Products.

Article 24: If a foreign entity or individual uses cryptography products or devices with cryptographic technology without permission, shall be warned by public safety agency (i.e. police) and ordered for correction (of this misconduct), and cryptography products or devices with cryptographic technology shall be seized.

Article 20: If there is one of the following conducts, cryptographic products shall be seized by Business Administration, or Customs, according to national cryptography administration and specific circumstances. Any illegal income shall be seized. Serious offenses shall be punished by a fine, one to three times of the illegal income.

* a) Without specifications, producing Commercial Cryptography Products, or the produced Commercial Cryptographic Products by specified entitys, exceeded the permitted scope.

* b) Without authorization, selling Commercial Cryptography Products.

* c) Without approval, importing cryptography products or devices with cryptographic technology, importing Commercial Cryptography Products, or selling foreign cryptography products.

Selling of Commercial Cryptography Products by approved entities not in accordance with the provisions, shall be warned and ordered for correction by national cryptography administration and Business Administration.

Article 21: If there is one of the following conducts, national cryptography administration shall warn public safety (i.e. police) or national security agency, and order for correction:

* a) In research or production of Commercial Cryptography Products, violate security or confidentiality requirements.

* b) Selling, Transporting or Keeping Commercial Cryptography Products, without required corresponding security measures.

* c) Without approval, publicize or exhibit Commercial Cryptography Products in public.

* d) Unauthorized (ownership) transfer of Commercial Cryptography Products, or repair Commercial Cryptography Products by unauthorized entity.

Using self-developed or foreign-produced cryptography products, or repair Commercial Cryptography Products by unauthorized entity by national cryptography administration, if the offense is serious, cryptography products shall be seized by national cryptography administration, public safety and national security agency.

------------------------------

According to this regulation, all CPUs are illegal since there's AES, most games are illegal since there's DRM, web browsing is illegal since there's SSL/TLS, all modern operating systems are illegal, etc. Around 2000, the government released an interpretation of the regulation, said this regulation does apply only to hardware devices, not computer software. But it still can't changed the fact that Intel CPUs are illegal. And if I remembered correctly, this interpretation has expired.

Basically this regulation is the result of typical government thinking before the Crypto War. And since it is impossible to fight a Crypto War in China, this remained unchanged.

Also, like most laws and regulations in China, they are unenforceable since they render most common things illegal, so they are hardly being enforced. In case of political persecution, they can put anyone in jail with these laws.

btw, I know someone on the Internet who was too happy about his smartcard, and showed the card to everyone, later his card was seized by national security agency, but in this case I don't think it is a real threat.

My publication of this comment is illegal, since it is transferred by SSL/TLS and computed by AES-NI instruction, with a password manager protected by a OpenPGP Card.

TL;DR: Stay Calm and Let's Encrypt.

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 17, 2017 4:13 UTC (Sat) by biergaizi (subscriber, #92498) [Link]

Also, and we see the most serious punishment of merely use a unauthorized cryptographic device, is the seizure of the device and national security agency gets noticed. But the question is, how do you "seize" a software? This is ridiculous. For example, "The police has seized OpenSSL..." looooool

On return to America

Posted Jun 16, 2017 20:38 UTC (Fri) by gowen (guest, #23914) [Link] (16 responses)

Probably worth familiarising yourself with the procedure when you return to the USA. Long story short, they can take all your devices, copy them and will probably give them back inside a week. Be prepared to give up your encryption keys when asked, unless you're a big fan of spending long periods of time in interrogation rooms.

Try to avoid being suspiciously brown.

On return to America

Posted Jun 16, 2017 22:42 UTC (Fri) by walex (guest, #69836) [Link] (5 responses)

IIRC there are some important points (which may be urban legends, but I doubt so) when passing US borders:

* Most border posts are extraterritorial, like Guantanamo, that is not part of USA territory, and USA laws do not apply there.
* If you are not an USA citizen you have no right of entry to the USA. It is entirely at the discretion of the borders officer, and they can detain you for any reason for any length of time.
* If you are an USA citizen you have a right of re-entry, as long as you have a document that proves that you are a citizen, but the border post is not part of USA territory, so that does not apply there. In any case if you hand over your passport to a border officer, she may "forget" that or "lose" it, and then you are no longer able to prove that you are a citizen.
* There is a long list of things that cannot be imported into the USA, some of them surprising, and where it is a felony to attempt to import them. It is very easy for border officers to plant such things on any device or baggage that you carry.
* It is very easy for people to "disappear" at border posts, USA citizens or not.
* In some difficult situations being a personal friend of a congressperson and having him come personally to "undisappear" you is the only way out.

Most times border officers won't press their advantage fully, but is they want to, there is little you can do. Most voters don't cross borders and think "better safe than sorry", "you can never be too safe", "safe at any cost to someone else", so them and politicians have effectively signed a blank cheque to security services, including police and border officers.

On return to America

Posted Jun 17, 2017 5:27 UTC (Sat) by Cyberax (✭ supporter ✭, #52523) [Link] (4 responses)

I actually commissioned a lawyer some time ago to get clarifications about border laws. So:

> * Most border posts are extraterritorial
Not true. US borders start in the territorial waters or on the other side of a land border line. Airports are most definitely within the US and ALL of the US laws apply, including non-discrimination laws.

However, simply being within a border control zone IS enough reason to be detained and to be subjected to a search.

> * If you are not an USA citizen you have no right of entry to the USA.
My lawyer's opinion is that if you are a permanent resident (a GC holder) then you are entitled to a deportation hearing before a judge (and with all the appeals afterwards), but border control officers are also free to keep you detained until the hearing.

Business/visitor visa holders can be denied entry on a whim with no real recourse.

> * If you are an USA citizen you have a right of re-entry, as long as you have a document that proves that you are a citizen
You might be detained long enough to establish your identity but the right of entry is unconditional. And I don't think that "losing" a passport is going to happen, all the border crossings are recorded on multiple video cameras.

> * There is a long list of things that cannot be imported into the USA, some of them surprising, and where it is a felony to attempt to import them.
Simply having a "regular" forbidden item in your luggage will lead to a fine (or nothing at all), it's a misdemeanor. Felony will require obviously illegal items like drugs or child porn.

> * It is very easy for people to "disappear" at border posts, USA citizens or not.
Detained people have an unconditional right to see legal council (or a consulate representative for foreigners) unless there's already an active deportation order in force.

On return to America

Posted Jun 20, 2017 9:32 UTC (Tue) by MKesper (subscriber, #38539) [Link]

Felony will require obviously illegal items like drugs or child porn.

Please remember that even pictures of your own naked children might be considered as such. Many people from other countries might not be aware of that. See for example https://www.auswaertiges-amt.de/sid_0AE273DFF08CB718C74C2...

On return to America

Posted Jun 20, 2017 15:44 UTC (Tue) by walex (guest, #69836) [Link]

>> * Most border posts are extraterritorial
> Not true. US borders start in the territorial waters or on the other side of a land border line.

So are foreign embassies and international organization headquarters, yet they are (to different degrees) extraterritorial too, by right of international treaty. Extraterritoriality as everybody knows is a legal concept, not geographical fact. Pointing out that most USA border crossings are usually contained geographically within USA borders is at best irrelevant.

> Airports are most definitely within the US and ALL of the US laws apply, including non-discrimination laws.

Airports, and their legal status, are not the same as the border posts within the airports, and their legal status.

>> * If you are an USA citizen you have a right of re-entry, as long as you have a document that proves that you are a citizen
> You might be detained long enough to establish your identity but the right of entry is unconditional.
> And I don't think that "losing" a passport is going to happen, all the border crossings are recorded on multiple video cameras.

That's completely ridiculous: someone who is detained "somewhere" as she claims that she is a USA citizen but has no documents to prove it, and indeed no entry documents at all, because she has "lost" her passport, brings suits in USA court to have the "top secret" camera records released to prove she had a passport, and thanks to those records, that are never "lost" either, she is released. Nice story! That might happen if her disappearance was indeed as mistake. If it was not, good luck.

>> * It is very easy for people to "disappear" at border posts, USA citizens or not.
> Detained people have an unconditional right to see legal council (or a consulate representative for foreigners)

With that right and two dollars you can buy a large latte in some places. Pointing out at theoretical rights without recognizing the chances of having them enforced is at best irrelevant.

The point is that while you can be arrested within the USA on a pretext (or on planted evidence) and then "disappear" into a malignant and opaque legal and jail system, or simply to be abducted and end up in a nice cell in the underground "detention facilities", there are still some minimal practical remedies that make that far easier to fix than"disappearing" at a border crossing. The practical status of nearly everybody at a border crossing is much the same as that of a dark skinned citizen in a police station in Tennessee in 1927, with all the 14th amendment rights that dark skinned citizen had. At a border crossing everything is stacked in favour of the authorities, whatever is or is not on your laptop or cellphone.

On return to America

Posted Jun 22, 2017 18:44 UTC (Thu) by jkingweb (subscriber, #113039) [Link] (1 responses)

>> * Most border posts are extraterritorial
> Not true. US borders start in the territorial waters or on the other side of a land border line. Airports are most definitely within the US and ALL of the US laws apply, including non-discrimination laws.

It's certainly true when preclearance happens like here in Canada: you'll go through customs outside US jurisdiction, and local territorial law applies. In the case of Canada the Charter of Rights and Freedoms and human rights legislation (which would probably apply rather than the Charter in this case) grant you significant protections while present in the country whether or not you are a citizen; for other places that have preclearance (like the UAE), you may have no particular legal protections.

On return to America

Posted Jun 22, 2017 18:53 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link]

And this contradicts my point exactly how?

On return to America

Posted Jun 17, 2017 1:41 UTC (Sat) by linuxrocks123 (subscriber, #34648) [Link] (8 responses)

If you're a US citizen, or, even if you're not, but you don't REALLLY want to visit the US that badly, I would refuse to give up encryption keys if asked. They might detain you a while if they want, and take your stuff, but, you're a citizen, they have to let you back in. If you're not, well, they at least have to let you back out.

Regarding what the poster above me said, US laws do apply at the border, but, when you're going through Customs, you basically have a very, VERY limited expectation of privacy, so most searches aren't considered to violate the Fourth Amendment, even if they would be totally illegal anywhere else. That may be the root of his confusion. Fifth Amendment rights, however, do apply, as does the Constitution as a whole.

Also, I'm pretty sure we don't disappear people at the border or destroy their passports. We've agreed to inform foreign consulates when we detain one of their citizens, and we do. Our own citizens have the full complement of protections against arbitrary detention with regard to Customs as anywhere else.

On return to America

Posted Jun 17, 2017 8:35 UTC (Sat) by andrey.turkin (guest, #89915) [Link] (7 responses)

It's funny how same article phrase:
> you may be asked to decrypt your devices for a search. Failure to do so may result in unpleasantness
applies to USA and UK as well as China, with varied amount of unpleasantness. USA and China are kind of similar here: you might get detained for a while (or deported if you are not a citizen), and your device ceized for an extended period of time or forever. Failure to decrypt your device in UK may result in jail time.

On return to America

Posted Jun 17, 2017 11:53 UTC (Sat) by nix (subscriber, #2304) [Link] (5 responses)

> Failure to decrypt your device in UK may result in jail time.

However, given that the only time the government tried this in the UK it led to a massive PR disaster, I suspect they'll be very careful about doing so again. (However, Theresa May is such a paranoid control freak that I could well be wrong.)

On return to America

Posted Jun 17, 2017 18:47 UTC (Sat) by andrey.turkin (guest, #89915) [Link] (4 responses)

I just started to wonder if that law even applies to UK customs. If such authority only applies to the police during crime investigation then it is not as wide-reaching as I though; at least in that case it wouldn't apply to a random search on the border (but still more potent than in US where such authority applies to judges only, and somewhat flimsy Fifth Amendment protection).

On return to America

Posted Jun 19, 2017 15:32 UTC (Mon) by Wol (subscriber, #4433) [Link] (3 responses)

The problem is that the UK offence is "failure to decrypt" or "failure to provide the key".

The fact that you may not have (and have never had) the key is no defence.

So if I plant an encrypted file on your computer AND YOU CAN PROVE IT, you are still committing an offence for which you can be jailed ...

Cheers,
Wol

On return to America

Posted Jun 19, 2017 15:54 UTC (Mon) by farnz (subscriber, #17727) [Link] (2 responses)

That's false - the offence in the Regulation of Investigatory Powers Act part III, which is the current law governing failure to decrypt, it is a statutory defence to demonstrate that you did not have the key at the point the decrypt order was given to you, and did not come into possession of it after the order was given to you. The exact wording is in section 53 of the Act:
For the purposes of this section a person shall be taken to have shown that he was not in possession of a key to protected information at a particular time if—
(a) sufficient evidence of that fact is adduced to raise an issue with respect to it; and
(b) the contrary is not proved beyond a reasonable doubt.

While the burden of proof is reversed (it's up to the recipient of the order to prove that they did not have the key), in the situation you describe, the fact that I can prove that you planted the encrypted file on my system, but not the key, is enough to act as a defence; of course, the likely outcome is a new decrypt order focused on you instead of me. I appreciate that, as someone not necessarily resident in the UK, you may be ignorant of our laws, but they are published in full on the National Archives Legislation site, and you can research them before repeating lies you've been told about them.

On return to America

Posted Jun 19, 2017 22:47 UTC (Mon) by anselm (subscriber, #2796) [Link] (1 responses)

While the burden of proof is reversed (it's up to the recipient of the order to prove that they did not have the key) […]

I don't think that's actually what this says. “A person shall be taken to have shown that he was not in possession of a key […] if the contrary is not proved beyond a reasonable doubt” means that the prosecution must prove beyond a reasonable doubt that the person was in possession of a key, or it will be assumed by default that the person wasn't. Alternatively, the person can actively provide “sufficient evidence to raise an issue” with respect to the prosecution's claim that they have a key, which is basically reasonable doubt from the other end.

Proving a negative is always difficult, and here the “person” does not have to prove conclusively that they don't have a key; they just need to poke a sufficiently large hole into the claim that they do.

On return to America

Posted Jun 20, 2017 0:16 UTC (Tue) by karkhaz (subscriber, #99844) [Link]

> Alternatively, the person can actively provide “sufficient evidence to raise an issue”

I don't think it's "alternatively". The sentence you're talking about contains an "and," not an "or":

For the purposes of this section a person shall be taken to have shown that he was not in possession of a key to protected information at a particular time if—
(a)sufficient evidence of that fact is adduced to raise an issue with respect to it; and
(b)the contrary is not proved beyond a reasonable doubt.

So indeed, your parent is right: the onus is on the defendant to produce sufficient evidence that they are not in possession of a key, and this is _in addition to_ their possession of a key not having been shown beyond reasonable doubt by the prosecution.

On return to America

Posted Jun 19, 2017 19:32 UTC (Mon) by spaetz (guest, #32870) [Link]

> Failure to decrypt your device in UK may result in jail time.

It can lead to prison time in the US too: https://www.engadget.com/2017/06/01/man-gets-180-days-in-...

On return to America

Posted Jun 17, 2017 4:15 UTC (Sat) by biergaizi (subscriber, #92498) [Link]

EFF has a more complete and comprehensive guide about U.S. Border. I highly recommend everyone to read it.

Digital Privacy at the U.S Border: A New How-To Guide from EFF
https://www.eff.org/files/2017/03/10/digital-privacy-bord...

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 17, 2017 4:07 UTC (Sat) by drag (guest, #31333) [Link]

If you don't want your data searched don't have the data on you when you cross. The advice on just having installation media on you when you cross borders is a good one. Having a jump server is good as well.

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 17, 2017 5:42 UTC (Sat) by NightMonkey (subscriber, #23051) [Link] (13 responses)

I like some of the ideas, though my own Crucial MX200 hardware-encrypted SSD hard drive I guess would make me disappear at the Chinese border. ;)

I wish more people would get religion with sshuttle. No need for "vpn" configuration. No special device files or kernel modules. No "port forward" rules. Just ssh + iptables and all of your traffic (including DNS resolution) is forced down the ssh pipe to a server of your choice.

https://github.com/sshuttle/sshuttle

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 17, 2017 16:50 UTC (Sat) by biergaizi (subscriber, #92498) [Link] (12 responses)

And your SSH server will be automatically spotted by traffic analysis and blocked in hours.

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 17, 2017 18:24 UTC (Sat) by drag (guest, #31333) [Link] (9 responses)

Really? Is that speculation or do you actually have some experience with this sort of thing?

VPNs and, I expect SSH as well, is a normal everyday thing for almost every business traveler. As is using https and other robust encryption methods. I find it unlikely that the Chinese State would have a automated process used to shut that sort of stuff down for any traveler unless they are suspected of something.

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 17, 2017 20:48 UTC (Sat) by misc (subscriber, #73730) [Link] (3 responses)

My boss was living in China for a few years, and he was complaining daily on the bad internet access and his VPN always broken. He did worked around filtering with custom patch on the VPN, but the traffic was a lot of time quite crappy, making it close to useless for some days.

I also remember a friend visiting China, and being unable to connect by ssh to the build cluster of the project we were working on. We did worked around by using another server as a jump host, but one had to wonder why the first was in some kind of blacklist, as it was back in the days before addresse recycling on cloud infra.

My teammates at Linuxcon Beijing also did express some frustration regarding Internet access, but were able to use Telegram without trouble, so I guess "it depend".

It might not be the GFW, it might just be "good enough" internet deployment, intercontinetal link being overloaded, or something else, but so far, I heard enough people complaining about crappy internet to think this is true.

And yeah, the Chinese Ministry of Communication do try to probe for Tor using active measures (like detecting bridges, etc) in the last years, so I wouldn't be surprised they do have now all kind of automation that might be buggy (or where they just do not care, see various articles on "close enough" mindset in China).

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 17, 2017 21:22 UTC (Sat) by halla (subscriber, #14185) [Link] (1 responses)

"My teammates at Linuxcon Beijing also did express some frustration regarding Internet access, but were able to use Telegram without trouble, so I guess "it depend". "

That can only mean one thing, and that's that Telegram is allowed because it can be inspected. One way or another.

Heck, ancient history time... I studied Sinology in Leyden in the late eighties, early nineties, and the landline phone in my student house in the Breestraat was tapped. It was analog, so the very distinctive tick tell-tale gave the tap away. The other students in the house were only doing law, history and Dutch Literature, so I was the only one doing a sensitive subject. Also, my year group had the same experience.

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 18, 2017 9:12 UTC (Sun) by linuxrocks123 (subscriber, #34648) [Link]

Nah, they might just be flying under the radar for now. Anything not super-popular is unlikely to be a priority for them.

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 20, 2017 11:04 UTC (Tue) by paulj (subscriber, #341) [Link]

As a counter-point, I've had a number of visits to China and never had problems SSHing out to server in EU, and proxying everything over by default.

I had a problem connecting to my SIP provider, but that turned out to be the European SIP provider just blacklisting Chinese IP blocks en masse.

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 18, 2017 9:06 UTC (Sun) by linuxrocks123 (subscriber, #34648) [Link] (4 responses)

They do appear to fuck with ssh in some way. I was never actually blocked with sshuttle, but the ssh connection became so slow as to be basically unusable for anything other than an interactive session. I suspect this was traffic shaping, though I can't be sure. The reason I can't be sure is because their connection to anything hosted in another country sort of sucks. They don't have a fat enough pipe out of the country, and it shows.

Still, I had a much happier time in subsequent trips there using softether over obfsproxy. So I do think they were fucking with ssh.

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 18, 2017 14:38 UTC (Sun) by biergaizi (subscriber, #92498) [Link] (3 responses)

They use machine-learning based algorithm to distinguish the traffic between SSH interactive session and SSH traffic forwarding. If traffic forwarding is detected, first the traffic will be set to the lowest QoS priority of all international traffic, later start to drop all packets and finally block the connection if the system thinks the server is dedicated for proxy.

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 19, 2017 6:40 UTC (Mon) by pinkynotthebrain (guest, #116009) [Link] (1 responses)

It would be interesting to see if Mosh (mosh.org) was any more immune, or at least more tolerant, of the Great Firewall's fuckery. SSH over MultiPath TCP to multiple intermediate IPs might also be "fun".

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 20, 2017 0:48 UTC (Tue) by biergaizi (subscriber, #92498) [Link]

It is not a problem if you use SSH for system management, the wall can tell the difference between traffic forwarding and system management, unless the IP address was put on the watchlist previously. Mosh does not forward traffic, so it is irrelevant here. It definitely works better on any unstable network.

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 29, 2017 8:05 UTC (Thu) by linuxrocks123 (subscriber, #34648) [Link]

How do you know this?

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 18, 2017 3:50 UTC (Sun) by NightMonkey (subscriber, #23051) [Link] (1 responses)

Yes, I'd love to hear real-world experience reports on SSH blocks, especially those on non-standard ports.

Ryabitsev:Travel (Linux) laptop setup

Posted Jun 18, 2017 5:46 UTC (Sun) by Cyberax (✭ supporter ✭, #52523) [Link]

They definitely sniff out and block SSH servers if they see a lot of traffic going through it. We had a team in China use a bastion server to log into our servers and this server got periodically blocked. They probably running some clustering analysis tools to identify interesting VPN servers. They also do active probes, so poor knocking is your friend.


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds