Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero-Trust RDP and SSH Access to VMs on Google Cloud

github.com

Post reply on HN
Print view View original

71–80 of 90 posts

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#71

Post by 0xEFF »

pritambaral wrote: post #52
CaliforniaKarl wrote: post #3

I make use of IAP and OS Login today, to log in to a Compute Engine Linux VM. The VM has Internet access via NAT, and has no public IP. Logging in is via `gcloud compute ssh`. Authenticating `gcloud` involves a corporate login which uses a client certificate and two-step. For all the components involved, it works pretty well!

> ... which uses a client certificate ... Can you encrypt the client private key on disk and use sth like ssh-agent?

Yes, simply add the key gcloud generates as normal using ssh-add ~/.ssh/google_compute_engine

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#72

Post by poetaster »

creshal wrote: post #17
nickysielicki wrote: post #12

I'm sorry if this sounds completely ridiculous to some people, but what do people use RDP/Windows server for in 2021? Given that ASP/Dotnet is portable to linux, what are people building that isn't better deployed to linux? It can't just be the legacy use-case, can it?

We use remote scripted Indesign instances for creating catalogues, which needs Windows to run, and RDP for debugging. I'd love to hear about alternative solutions that don't require Windows, and still spit out colour-accurate CMYK indesign files; the printing shops won't accept anything else.

Jeez. Reminded of scripting quark with apple script. And photoshop cmyk tiff separations, I don't recall, but the workflow was scripted. I frankly can't imagine what that looks like today.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#73

Post by chucky_z »

hardwaresofton wrote: post #69

Inspired by Fly.io's post a while ago[0] I also did something similar to this on my small k8s cluster with the help of stunnel, sslh, and traefik[1]. Weirdly enough I thought this was the ability to provision a wireguard-esque proxy to any machine you want, operated at the edge of the cloud, but it seems like it's really TCP-over-HTTPS. It's easy to imagine doing the former (dynamic wireguard proxy surfacing) too tho…

I run IAP. It's TCP-over-HTTPS but it works remarkably well, connects to all kinds of things, and for users it really is just "login with google, proceed as normal."

I use a JWT proxy + ghostunnel within GKE with a VIP so it's not quite their reference setup but it's extremely "just works" outside GKE being weird and eating its own routes.

BTW, side-note but try out ghostunnel over stunnel! I've really enjoyed using it and it's been fantastic to debug and work with.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#74

Post by pidminusone »

franga2000 wrote: post #35
nickysielicki wrote: post #12

I'm sorry if this sounds completely ridiculous to some people, but what do people use RDP/Windows server for in 2021? Given that ASP/Dotnet is portable to linux, what are people building that isn't better deployed to linux? It can't just be the legacy use-case, can it?

RDP is pretty easy to explain: if you need a GUI, RDP is infinitely smoother than VNC or anything else the Linux ecosystem has to offer. I even use it on Linux for things like livestreaming (OBS running in a minimal GUI like openbox). The are many similar workloads that are less "servers" and more "cloud workstations" that use GUI apps. As for Windows in general, 90% of the Windows servers I see fall into one of the…

That was sort of my company's IT story.

In the beginning they needed AD because business is heavily Windows centric.

Then they started using Windows Server for DNS, business apps, shared volumes, etc...

After I joined I started separating concerns / reducing blast radius and now we use Windows Server for AD and a few apps that are Windows only.

Azure AD + Intune MDM is getting better and I think we will be able to kill our managed AD soonish though.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#75

Post by sillystuff »

CaliforniaKarl wrote: post #3

I make use of IAP and OS Login today, to log in to a Compute Engine Linux VM. The VM has Internet access via NAT, and has no public IP. Logging in is via `gcloud compute ssh`. Authenticating `gcloud` involves a corporate login which uses a client certificate and two-step. For all the components involved, it works pretty well!

You can also add it to your ~/.ssh/config, so you can just ssh hostname, scp hostname, etc. without a public IP on the VM.

  Host myhost
       ProxyCommand gcloud compute ssh user@myhost --zone=myzone --tunnel-through-iap --command="nc 0.0.0.0 22" -- -o "UserKnownHostsFile /dev/null" -o "StrictHostKeyChecking no"

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#76

Post by dekhn »

nickysielicki wrote: post #12

I'm sorry if this sounds completely ridiculous to some people, but what do people use RDP/Windows server for in 2021? Given that ASP/Dotnet is portable to linux, what are people building that isn't better deployed to linux? It can't just be the legacy use-case, can it?

I run many GUI apps remotely. I don't waste time porting stuff that works best on Windows to Linux (I have two machines). Not all use cases are development.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#77

Post by dekhn »

OrvalWintermute wrote: post #63
franga2000 wrote: post #35

Earlier quoted context omitted.

RDP is pretty easy to explain: if you need a GUI, RDP is infinitely smoother than VNC or anything else the Linux ecosystem has to offer. I even use it on Linux for things like livestreaming (OBS running in a minimal GUI like openbox). The are many similar workloads that are less "servers" and more "cloud workstations" that use GUI apps. As for Windows in general, 90% of the Windows servers I see fall into one of the…

> RDP is pretty easy to explain: if you need a GUI, RDP is infinitely smoother than VNC or anything else the Linux ecosystem has to offer. The last time I was assessing Windows remote * for performance, VNC* implementations with a mirror driver provided far better performance than vanilla RDP.

I have the complete opposite experience, but I only used RealVNC (not sure what mirror driver is). My experience is that the Windows RDP client and RDP server on any platfrom is >>> VNC in every way.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#79

Post by hardwaresofton »

chucky_z wrote: post #73
hardwaresofton wrote: post #69

Inspired by Fly.io's post a while ago[0] I also did something similar to this on my small k8s cluster with the help of stunnel, sslh, and traefik[1]. Weirdly enough I thought this was the ability to provision a wireguard-esque proxy to any machine you want, operated at the edge of the cloud, but it seems like it's really TCP-over-HTTPS. It's easy to imagine doing the former (dynamic wireguard proxy surfacing) too tho…

I run IAP. It's TCP-over-HTTPS but it works remarkably well, connects to all kinds of things, and for users it really is just "login with google, proceed as normal." I use a JWT proxy + ghostunnel within GKE with a VIP so it's not quite their reference setup but it's extremely "just works" outside GKE being weird and eating its own routes. BTW, side-note but try out ghostunnel over stunnel! I've really enjoyed using…

> I run IAP. It's TCP-over-HTTPS but it works remarkably well, connects to all kinds of things, and for users it really is just "login with google, proceed as normal."

Yeah that's really amazing, with client-side software like they've already made and I've seen from other vendors (whether GUI or TUI) the interfaces IaaS/PaaS companies can build are really slick. Looks like they'll be able to cut down on dashboard fatigue/complexity people are wrangling quite a bit.

> I use a JWT proxy + ghostunnel within GKE with a VIP so it's not quite their reference setup but it's extremely "just works" outside GKE being weird and eating its own routes.

Interesting, so JWT proxy (or any other auth mechanism that is viable over HTTPS) -> ghostunnel machine w/ public VIP -> Target machine ? Or ghostunnel directly running on the Target machine which holds the public VIP? Or does the JWT proxy take the public IP and the ghostunnel machine keep the private VIP?

Apologies just want to be able to picture your solution clearly.

> BTW, side-note but try out ghostunnel over stunnel! I've really enjoyed using it and it's been fantastic to debug and work with.

Thanks for the recommendation of ghostunnel, will use it in the future over stunnel next time I hack together something like this.

BTW: super-side note, breath of fire III avatar was a blast from the past, instantly recognized it.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#80

Post by handrous »

thowawaypets wrote: post #56
corty wrote: post #51

Earlier quoted context omitted.

Because when your herd of cattle is sick, you need to grab one and have a vet look at it before your whole herd dies from the plague.

No, part of managing a heard is having the right tools in place. Like monitoring, logging, and observability tools. There is nothing I can learn from accessing a VM in production that I can't learn from my monitoring system. In prod where I work, if someone logs into a production VM we mark it tainted and replace it with a fresh instance. This keeps things nice and consistent. Of you need an interactive session on a…

The overhead of ideal levels of automation, like

> In prod where I work, if someone logs into a production VM we mark it tainted and replace it with a fresh instance. This keeps things nice and consistent.

doesn't make sense from an ROI perspective, at a great number of businesses. Like, "this would take a decade to pay off, and that's assuming it requires no maintenance" kind of bad ROI.

Lots of places, you script vm/server configs (even just with bash) and get CI running automated tests on important branches, and you've captured 99% of the benefit available from automation. Would the other stuff be nice? Yes, but five people saving 15 minutes per week means you can't reasonably spend the kind of time on it—for initial set-up and for ongoing maintenance—that you would if it were fifty people saving 15 minutes per week, let alone 500 (at that point you can have a couple people dedicated full-time to just that one piece of automation, and it's still saving you money).

Post reply on HN