Proxying and analysing sftp

[seanliam5373]

Does anyone know if there is a package or device available that will firstly proxy sftp traffic and also do lexical analysis of the files being transferred ??

[ph34r]

I think you'd have to "break" the ssh encryption to do that....

[bwkaz]

proxy sftp traffic Only if the user logging in through this proxy device ignores the blatant warnings that their sftp client gives them. You can't proxy SSL-secured traffic unless you have the private key that the server uses. And with SSH (which is what sftp tunnels under), the public key for the server's private key is hashed down to a fingerprint, and this fingerprint is compared to the last-used fingerprint by the client. (If there is no last-used fingerprint for this server, then the client alerts the user to verify the fingerprint manually.)

If the fingerprints don't match, then ssh clients aren't supposed to let the connection continue.

And even if you get around that, what's your proxy supposed to use for the credentials when logging into the real sftp server? If the user provides a password, you might be able to use that, but if the user uses public key authentication, you can't get at their private key. So you can't use it to log in as them. (And given the amount of ssh brute-forcing that's been going for the last few years, I'd be surprised if very many people allow password authentication for ssh anymore. They're just asking to get attacked.)

and also do lexical analysis of the files being transferred ?? This would require breaking the encryption, as ph34r said. If you can't break the encryption (and you can't), then the only option is a man-in-the-middle attack, which is what the fingerprinting defends against on the client, and what the private-key authentication requirement defends against on the server.