<story><title>How I learned about corporate firewalls</title><url>https://www.valcanbuild.tech/handling-corporate-firewalls/</url></story><parent_chain><item><author>huy-nguyen</author><text>I work at a government agency and here are my tales.&lt;p&gt;1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have to get off the VPN every time I need to run these simple commands. IT absolutely doesn&amp;#x27;t give a flying **** about developers.&lt;p&gt;2) They ban all non-Chrome browsers from being installed. As in, if you install such a browser and try to launch it, the system will say &amp;quot;browser X is banned. Contact IT.&amp;quot; They would have banned Safari too had it not been part of the OS. Furthermore, they also disabled private browsing in Chrome (probably the ability to do this is why they allow Chrome). I think they&amp;#x27;re preventing people from hiding their internet browsing.</text></item></parent_chain><comment><author>sillystuff</author><text>The MiM might not be your IT folks, but rather management.  I was in a meeting which included folks from Palo Alto (PA) and management where PA was hard selling their ability to MiM all https connections and link all activities of the users to their usernames through various methods from directory integration to log scraping on radius servers.  The managers were super excited about the possibilities.  Management not only wanted to implement this, but wanted to do so in secret.  IT folks were pushing back-- hard.&lt;p&gt;Firewall as bossware.&lt;p&gt;Firefox being banned is because it uses its own certificate store, so Firefox users would see a browser warning every time they visit any https site notifying them that their traffic is being MiM&amp;#x27;d.  Chrome and chrome reskins like MS Edge use the OS store which MS Windows centric organizations can easily (centrally using MS tools [GP]) add the trusted CA for MiM into.  For the Macs, it probably wouldn&amp;#x27;t matter since the 3rd party mgmt tools could probably push out either.</text></comment>
<story><title>How I learned about corporate firewalls</title><url>https://www.valcanbuild.tech/handling-corporate-firewalls/</url></story><parent_chain><item><author>huy-nguyen</author><text>I work at a government agency and here are my tales.&lt;p&gt;1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have to get off the VPN every time I need to run these simple commands. IT absolutely doesn&amp;#x27;t give a flying **** about developers.&lt;p&gt;2) They ban all non-Chrome browsers from being installed. As in, if you install such a browser and try to launch it, the system will say &amp;quot;browser X is banned. Contact IT.&amp;quot; They would have banned Safari too had it not been part of the OS. Furthermore, they also disabled private browsing in Chrome (probably the ability to do this is why they allow Chrome). I think they&amp;#x27;re preventing people from hiding their internet browsing.</text></item></parent_chain><comment><author>TheRealDunkirk</author><text>Oh, how I have learned the hard way on this.&lt;p&gt;Our IT now blocks outbound SSH &lt;i&gt;entirely&lt;/i&gt;. You know, the &lt;i&gt;secure&lt;/i&gt; way to access VM&amp;#x27;s in, say, our cloud? Sigh. I&amp;#x27;m sure there&amp;#x27;s a &amp;quot;jump&amp;quot; server somewhere that I&amp;#x27;d have to log into, `sudo` to another account, THEN SSH to my target box. Whatever. I just avoid the VPN.&lt;p&gt;I used to use `cntlm` to tunnel requests through our firewall for things like Ruby&amp;#x27;s bundler, as it required NTLM authentication. Now they&amp;#x27;ve also gone the additional mile, and installed a certificate (Cisco Umbrella) in all of our computers, and require its signature to pass the firewall. Unfortunately, it took me a long time to sort this out:  why `cntlm` no longer worked, and why none of the usual suggestions on SO fixed it. I finally figured out that RubyInstaller for Windows included a nice facility to deal with this. You just place additional certs in a directory, run a Ruby script, and it will bundle the whole stack into a single .pem, which it will reference for all network-related commands. Thankfully, bundler&amp;#x27;s error messages were telling me the specific certs I needed, and I could download them from Cisco&amp;#x27;s web site.&lt;p&gt;Just about a month ago, my company started requiring that cert for ALL traffic, not just HTTP(S). Like for, say, Postgres connections on port 5432. I finally realized that I could reference that same SSL bundle in my Postgres client connections, and get through.&lt;p&gt;I&amp;#x27;ve spent about 8 years here now, and it&amp;#x27;s been a cat-and-mouse game the whole time. I&amp;#x27;m always wondering what&amp;#x27;s coming next.</text></comment>