Virtual Hosting Security Question

Howdy,

I am developing a content support service for webmasters. At the moment
I am sorting out the architecture. In my particular case the data in
question requires a rather high level of security, is time sensative
but has a relatively small throughput requirement. What I'm intending
to do is so:

enduser<--->webhost<--->SSH<---->remote-content-provider

So essentially, the webhost has a CGI script with an integrated SSH
client. When the connection is received by the webserver an outbound
SSH connection on a high numbered port is made to remote host. The
content is issued, preprocessed on the web server, and shown to the end
user.

I am aware that there are other ways to accomplish this, however I
would prefer THIS way given the data and nature of the additional
software infrastructure required for the service. (Read as: I code less
if I can do it this way)

My question is this: Do virtual hosting companies typically filter
outbound TCP connections for non-standard ports?

Thanks
Matt

William Tasso wrote:
> Fleeing from the madness of the http://groups.google.com jungle
> shrike DeleteThis @cyberspace.org <shrike DeleteThis @cyberspace.org> stumbled into
> news:alt.www.webmaster
> and said:
>
> > Howdy,
>
> How do you do?
>
> > ...
> > So essentially, the webhost has a CGI script with an integrated SSH
> > client. When the connection is received by the webserver an outbound
> > SSH connection on a high numbered port is made to remote host.
> > ...
> > My question is this: Do virtual hosting companies typically filter
> > outbound TCP connections for non-standard ports?
>
> Some do, some don't.
>
> Others will open a port if the request is reasonable. Why can't you use
> port 22?
>
> --
> William Tasso
>
> http://williamtasso.com/words/what-is-usenet.asp

Thanks for the reply,

Well I'm hoping this little protocol I'll be carrying over SSH will
eventually get standardized. Being predisposed to laziness I'm just
writing my protocol as Unix Shell and calling it a session protocol.
(Hey, somebody has to use layer 5!)

I'm using a dedicated instance of sshd chrooted in a little jail with
my protocol/shell. So obviously the ports have to be different between
my two running ssh daemons.

But the big reason I don't want to use TCP/22 is because I would like
to release a short draft once the proto is hashed out and GPL the code.
It is the polite thing to do, and will keep others from stepping on my
toes or vice/versa by using the same port. I've done that bit before w/
another protocol I wrote.

I guess if the customer asks for it the ISP is obliged to consider it.
I would just rather avoid troubleshooting other peoples firewall
policies if I can possibly help it.

Any experience with this sort of thing?

-Matt