21–30 of 125 posts
Not sure why you'd use this instead of something like ZeroTier or a bounce box, but I can think of one reason: you want to hide the location of something in your infrastructure to make side channel attacks on the cloud provider or physical location a lot harder.
Being a small cog, but using clever tricks to get your job done is not solving the problem. An organisation that prevents itself from acting rationally is an organisation that should die Schumpter-style. Please don't prevent it.
Earlier quoted context omitted.
Or better yet, use cloudflare tunnels and setup an actual permanent tunnel with custom subdomain support. If you want it to be a temporary one, it supports that too. For FREE.
Is that part of Cloudflare Teams? No offense to Cloudflare, but their pricing is really unclear. I have an account and I use them for a lot, but they have 3 different "plans" and then they have various ad-hoc products. Tunnel just says "view in dashboard." [0] If I click on that link while logged in, I'm taken to my dashboard with no indication of how to use Tunnel or anything. The plans page [1] indicates that it's…
product page says it requires paid Argo (smart routing) subscription https://www.cloudflare.com/en-gb/products/tunnel/
the blog page says its free https://blog.cloudflare.com/tunnel-for-everyone/
and actually you can install and run it quite easily
brew uninstall cloudflare/cloudflare/cloudflared
cloudflared login
cloudflared tunnel
Being a small cog, but using clever tricks to get your job done is not solving the problem. An organisation that prevents itself from acting rationally is an organisation that should die Schumpter-style. Please don't prevent it.
Also circumventing this sort of thing in many orgs is a first class ticket to finding a new job. Friend of mine did that, they walked him to the curb with his cardboard box that day. His sin? Turned off virus scanning because it was taking 4 hours to do a 20 min build.
In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…
at our lab the tor traffic would be noticed by the cyber security group's ids and all traffic from your host would start dropping at the border so fast your head would spin. you'd get an unpleasant phone call or visit to your office and be warned never to try side stepping the bastion ssh hosts that log all the things ever again.
One very important thing not mentioned is that the tor exit node could be capturing your traffic or do a MITM attack. Its a great idea for testing but only after you have encryption working, and of course pay special attention to your ssh fingerprints.
In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit. One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be t…
Think from the beginning what will be the end: "I thought your security policy was too overbearing, so I used tor." IT departments make their choices for reasons. The key is to help them understand your use-case, and they'll probably help you through the problem in a way that might limit collateral damage. Source: have seen firewall bypasses (with a pre-shared key) get leveraged as a way to hack an entire university…
Normally this is fine, but my job involves programming and controlling large, expensive, and strangely fragile lab equipment. There's a resilience problem, and it's got to the point where others have suggested putting a GSM modem on a pci-e card inside some of the boxes in question, as the relevant IT department decides on a whim to block ports with no warning or justification. Some manufacturers of the devices in question do this as standard if you have a support contract. Trying to complain results in responses like "you have been used to doing things one way and this change now prevents you from working as before."
I completely accept that this is a political problem and best solved as one, but ultimately SSH is an industry standard for a reason -- it's secure, and it's flexible. The machines in question are valuable, prone to breaking in the middle of the night, and we are an international bunch who cannot always connect from a well-defined ipv4 address, or from the university's VPN. (The latter is blocked by the IT department automatically, as it has too large a pool of potential users). The thing I find most frustrating is that this sort of political decision creates days worth of work instantaneously, for little benefit. All of the actually confidential or sensitive information is held in a completely separate network at any rate...