Auditing and policy control at SSH endpoints

1. A method comprising:

receiving, in a firewall from a policy server, policy information including instructions for interception of encrypted communications;

intercepting and decrypting, in the firewall at least a part of an encrypted communication, at a packets level, according to a first encrypted protocol in accordance with the policy information; and

sending at least a part of the decrypted communication from the firewall to an audit server using a network protocol,

wherein the firewall is a device that performs stateful inspection of data packets, and

wherein the audit server is not within the firewall.

2. The method of claim 1 , wherein the first encrypted protocol is the Secure Shell (SSH) protocol, the Virtual Network Computing (VNC) protocol, or the Remote Desktop Protocol (RDP) protocol.

3. The method of claim 1 , further comprising:

intercepting a sent packet belonging to the communication before it is encrypted by the firewall; and

intercepting a received packet belonging to the communication after it has been decrypted by the firewall.

4. The method of claim 1 , further comprising:

making a policy decision about whether to allow a port forwarding request.

5. The method of claim 1 , further comprising:

deciding whether to allow an intercepted protocol operation based on a policy rule received from the policy server, where the protocol operation is selected from the group consisting of: opening a port forwarding channel, opening a session channel, transferring a file, opening a file, creating a file, modifying a file, reading a file, removing a file, renaming a file, advertising a device, opening a device, advertising a printer, and opening a printer.

6. The method of claim 1 , further comprising:

intercepting a request to transfer data using the first encrypted protocol and accepting or rejecting the request based on a response from a data loss prevention (DLP) system to a query about the data.

7. A firewall comprising:

one or more processors; and

at least one non-transitory memory comprising program code for causing, with the one or more processors, the firewall to:

receive, from a policy server, policy information including instructions for interception of encrypted communications;

intercept and decrypt at least a part of an encrypted communication, at a packets level, according to a first encrypted protocol in accordance with the policy information; and

send at least a part of the decrypted communication to an audit server using a network protocol,

wherein the firewall is a device that performs stateful inspection of data packets, and

wherein the audit server is not within the firewall.

8. The firewall of claim 7 , wherein the at least one memory further comprises program code for causing the firewall to:

intercept a sent packet belonging to the communication before it is encrypted by the firewall; and

intercept a received packet belonging to the communication after it has been decrypted by the firewall.

9. The firewall of claim 7 , wherein the at least one memory further comprises program code for causing the firewall to:

decide whether to allow an intercepted operation defined in the first encrypted protocol based on policy received from the policy server.

10. The firewall of claim 7 , wherein the at least one memory further comprises program code for causing the firewall to:

block a request to transfer data using the first encrypted protocol in response to data loss prevention system (DLP) identifying the data as data whose transfer is not allowed.

11. A computer program product for a firewall stored on a non-transitory computer-readable medium comprising program code operable to cause the firewall to:

receive, from a policy server, policy information including instructions for interception of encrypted communications;

intercept and decrypt at least a part of an encrypted communication, at a packets level, according to a first encrypted protocol in accordance with the policy information; and

send at least a part of the decrypted communication to an audit server using a network protocol,

wherein the firewall is a device that performs stateful inspection of data packets, and

wherein the audit server is not within the firewall.

12. The computer program product of claim 11 , wherein the first encrypted protocol is the Secure Shell (SSH) protocol.

13. The computer program product of claim 11 , wherein the first encrypted protocol is the Remote Desktop Protocol (RDP).

14. The computer program product of claim 11 , further comprising program code operable to cause the firewall to:

intercept a sent packet belonging to the communication before it is encrypted by the server; and

intercept a received packet belonging to the communication after it has been decrypted by the server.

15. The computer program product of claim 11 , further comprising program code operable to cause the firewall to:

make a policy decision about whether to allow a request defined in the first encrypted protocol.

16. The computer program code of claim 11 , further comprising program code operable to cause the computer to

act as a server for Secure Shell (SSH) connection, and

send information related to the Secure Shell connection to the audit server in plaintext.

17. The computer program code of claim 11 , further comprising program code operable to cause the computer to

act as a client for Secure Shell (SSH) connection, and

send information related to the Secure Shell connection to the audit server in plaintext.