1

I'm confused about how ssh dynamic port forwarding operates with https. Assuming 3 machines:

  • A runs a web browser
  • B runs sshd
  • C is a web server

On A, I "ssh -D 12345 user@B" and configure the browser to use the SOCKS proxy at localhost:12345. I can check the host key of B, and if I was directly viewing an https site (A -> C) I could check the certificate to notice a MitM.

What I want to know is: where does the https decryption take place when the proxy is in-place?

Is ssh at B just forwarding unmodifed packets received from C (wrapped in its own layer of encryption obviously) to A for decryption in the browser, or have I effectively man-in-the-middled the A->C connection myself? If ssh at B was decrypting data from C, before re-encrypting it to send back to A, that would be undesirable as the data now exists (albeit only in memory) in a decrypted state on B. Which of the two scenarios is it? I'm assuming it's the former, but I want to be clear about what is going on. Thank you

1 Answer 1

2

HTTPS is only ever decrypted in your browser. Nothing else has the required keys.

If a third party is decrypting and re-encrypting the data, it’s a MitM attack that you would notice unless the service’s certificate is compromised.

Because the SSH tunnel does not transport IP packets but only their contents, they aren’t unmodified. The contents however, are unmodified.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .