Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero-Trust RDP and SSH Access to VMs on Google Cloud

github.com

Post reply on HN
Print view View original

81–90 of 90 posts

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#81

Post by nickysielicki »

creshal wrote: post #17
nickysielicki wrote: post #12

I'm sorry if this sounds completely ridiculous to some people, but what do people use RDP/Windows server for in 2021? Given that ASP/Dotnet is portable to linux, what are people building that isn't better deployed to linux? It can't just be the legacy use-case, can it?

We use remote scripted Indesign instances for creating catalogues, which needs Windows to run, and RDP for debugging. I'd love to hear about alternative solutions that don't require Windows, and still spit out colour-accurate CMYK indesign files; the printing shops won't accept anything else.

This is exactly the sort of use case I wasn't imagining. Thanks for sharing.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#83

Post by chucky_z »

hardwaresofton wrote: post #79
chucky_z wrote: post #73

Earlier quoted context omitted.

I run IAP. It's TCP-over-HTTPS but it works remarkably well, connects to all kinds of things, and for users it really is just "login with google, proceed as normal." I use a JWT proxy + ghostunnel within GKE with a VIP so it's not quite their reference setup but it's extremely "just works" outside GKE being weird and eating its own routes. BTW, side-note but try out ghostunnel over stunnel! I've really enjoyed using…

> I run IAP. It's TCP-over-HTTPS but it works remarkably well, connects to all kinds of things, and for users it really is just "login with google, proceed as normal." Yeah that's really amazing, with client-side software like they've already made and I've seen from other vendors (whether GUI or TUI) the interfaces IaaS/PaaS companies can build are really slick. Looks like they'll be able to cut down on dashboard fat…

haha i've used garr as an avatar for a super long time now!

> Interesting, so JWT proxy (or any other auth mechanism that is viable over HTTPS) -> ghostunnel machine w/ public VIP -> Target machine ? Or ghostunnel directly running on the Target machine which holds the public VIP? Or does the JWT proxy take the public IP and the ghostunnel machine keep the private VIP?

jwt proxy takes in the iap jwt, they give you the audience and it's just parsed, this lives in the same pod as ghostunnel. ghostunnel goes through a NAT to a public dest, where ghostunnel is _also_ running. it has extremely strict TLS requirements (Forced valid CN to be sent/accepted, strict DNS, along with a single purpose CA, cert, and key).

It's like

IAP =inside-gcp=> (JWT proxy -> ghostunnel) =public=> (ghostunnel -> thing)

There's a more modern way to do this, but this works really well and gives absolutely fantastic introspection, is super easy to use it as a public proxy, and allows you to only use minimal APIs in GCP (IAP + GKE, you don't need GKE but you also don't wanna manage all the things it does for you with annotations. :D)

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#84

Post by hardwaresofton »

chucky_z wrote: post #83
hardwaresofton wrote: post #79

Earlier quoted context omitted.

> I run IAP. It's TCP-over-HTTPS but it works remarkably well, connects to all kinds of things, and for users it really is just "login with google, proceed as normal." Yeah that's really amazing, with client-side software like they've already made and I've seen from other vendors (whether GUI or TUI) the interfaces IaaS/PaaS companies can build are really slick. Looks like they'll be able to cut down on dashboard fat…

haha i've used garr as an avatar for a super long time now! > Interesting, so JWT proxy (or any other auth mechanism that is viable over HTTPS) -> ghostunnel machine w/ public VIP -> Target machine ? Or ghostunnel directly running on the Target machine which holds the public VIP? Or does the JWT proxy take the public IP and the ghostunnel machine keep the private VIP? jwt proxy takes in the iap jwt, they give you the…

Ahhh thank you for the detail, I understand the setup now -- I hadn't taken into account the IAP (intra GCP) bit!

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#85

Post by password4321 »

cprecioso wrote: post #14
nickysielicki wrote: post #12

I'm sorry if this sounds completely ridiculous to some people, but what do people use RDP/Windows server for in 2021? Given that ASP/Dotnet is portable to linux, what are people building that isn't better deployed to linux? It can't just be the legacy use-case, can it?

I use Windows VMs on Google Cloud to install and play games in the cloud - my Mac can’t play any

Nvidia GeForce Now offers this for free, 1 hour at a time.

It barely worked in their web client but the desktop client worked pretty well.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#87

Post by cprecioso »

password4321 wrote: post #85
cprecioso wrote: post #14

Earlier quoted context omitted.

I use Windows VMs on Google Cloud to install and play games in the cloud - my Mac can’t play any

Nvidia GeForce Now offers this for free, 1 hour at a time. It barely worked in their web client but the desktop client worked pretty well.

For me GeForce NOW is the best service, but it really sucks that I’m not allowed to play my whole Steam library. That’s a disqualified for me

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#88

Post by pritambaral »

0xEFF wrote: post #71
pritambaral wrote: post #52

Earlier quoted context omitted.

> ... which uses a client certificate ... Can you encrypt the client private key on disk and use sth like ssh-agent?

Yes, simply add the key gcloud generates as normal using ssh-add ~/.ssh/google_compute_engine

No, I meant the client private key that gcloud uses to authenticate itself (on your behalf) to Google's servers, not you to your servers. That wouldn't be an SSH key, probably TLS or hand-rolled crypto.

----

Also, now that you mention it, even if I encrypted the generated SSH key, wouldn't running a `gcloud ...` command again just ... re-generate the key, in unencrypted form?

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#89

Post by CaliforniaKarl »

pritambaral wrote: post #88
0xEFF wrote: post #71

Earlier quoted context omitted.

Yes, simply add the key gcloud generates as normal using ssh-add ~/.ssh/google_compute_engine

No, I meant the client private key that gcloud uses to authenticate itself (on your behalf) to Google's servers, not you to your servers. That wouldn't be an SSH key, probably TLS or hand-rolled crypto. ---- Also, now that you mention it, even if I encrypted the generated SSH key, wouldn't running a `gcloud ...` command again just ... re-generate the key, in unencrypted form?

Sorry, I should clarify: The client key is used in our corporate login.

When I log in to `gcloud`, that goes through our corporate login. Corporate login uses a client certificate and two-step.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#90

Post by seized »

malf wrote: post #20
etaioinshrdlu wrote: post #4

I didn't know big tech companies were still capable of making GUI's that look like this.

In my mind that keyboard navigable tree widget is the one redeeming feature of windows. I guess the age of “keyboard first” is long gone :(

Except for tab always being backwards for me. It goes up...
Post reply on HN