[DrPereira]

I'm not sure this is the place for such a question; if not, I apologize in advance and ask guidance to the right place.

I'm in a (public administration) network, and our work PCs were all changed recently.

They're running Ubuntu 18.04, with no significant mods that I can see.

The thing is, they all have remote SSH viewing enabled by default, and impossible to shut down without admin login.

Our old computers enabled that only if you ran TeamViewer, and with express knowledge.

Since most of my computer work is M.D. level access to patient registers, I'm concerned about screen mirroring and keylogging regarding what I'm working upon (yeah, they are THAT much corrupt). I see that as a breach of patient-doctor confidentiality that I cannot allow.

My first solution was to use a TP-Link WR740N with micro DD-WRT that I had lying around unused and use it beetween machine and ethernet connection, and configure it to block all SSH requests; it "worked", but now I have two problems:

1) I need a way to test if all SSH incoming and outgoing from the machine is blocked, sans admin access on the client;

2) If I connect my personal machine on said router, it gets no internet connection, even though the work PC does, even routed. I tried MAC cloning, to no avail.

Thanks in advance. I know I'm a noob playing with fire, but I believe the cause is just. Willing to provide information and learn as I go.

[Wildlion]

It sounds as though you are wanting to create an external firewall for a machine that you do not have admin access to.

Based on that assumption, how much access are you wanting the machine to have?

The most secure way would be to set the router up to by default deny all. If you are using teh router to do NAT, then incoming will all be denied, unless you open up a hole yourself. For the outgoing side, you would add a rule to the firewall denying all except things like http, https, dns, ntp.

To just deny outgoing ssh from machines through the router it is:

iptables -I FORWARD -p tcp -m tcp --dport 22 -j DROP

this is not blocking ssh traffic into the source machine, just out of (that is being blocked by NAT, and you would not know what the destination port is but you would know the source port of 22)

Once a machine is on the router's unmanaged switch there is nothing that you can do to stop traffic. In that case you would want to physically secure the router so that no one could plug in to one of the ports (and have wi-fi disabled)

[DrPereira]

Thanks for the prompt response.

Yeah,this will probably be enough; I want the work machine to have the access it needs to run the electronic medical record interface (node.js over HTTPS, if I understand correctly), I just don't want someone from IT snooping over SSH while I'm working with sensitive data.

There should be no "leaking" problems, since the "middle-man" router is mine; I'm interposing (patching?) the connection from the work machine to the local router.

If I'm talking out of my ass, or need to observe any other caveats, all info and criticism is appreciated.

I'm so proud of this community! (insert meme here) 😎

[SolderAmateur]

[Alozaros]

and if they are clever they would've change ssh port too..
so they will be using any other than 22..
this is cats'n dogs game....
as Wildlion suggested deny all and than build
only permitted connections.... its the only way, you can do something...but even thou, if they are ISP..they can still see the communication..so you'd need a VPN + DNS over HTTPS or TLS or DNScrypt...
to find out what is running, you can use tcpdump, nmap, wireshark, ggl those, they have good manuals to start with...
with a bit of digging here and there, you will make it as you wish..its not a brain surgery...

[DrPereira]

[Alozaros]

[Wildlion]

The best part is when you start using normal ports. Think things like DNS over HTTP or HTTPS. You cannot block outgoing to port 80 or 443, because you are wanting internet access.