Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH into private machines from anywhere using Cloudflare Tunnel

orth.uk

Post reply on HN
Print view View original

181–190 of 197 posts

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#181

Post by IggleSniggle »

api wrote: post #122
anderspitman wrote: post #120

Earlier quoted context omitted.

FWIW your "decentralize until it hurts, then centralize until it works" is one of my favorite slogans, and I appreciate y'all making the effort.

It's nice to hear that someone cares about this. I feel like a lunatic howling at the moon. We think decentralization (actual decentralization) is a good thing, but it would be so easy to just run a cloud silo. Everything becomes totally straightforward and simple. I also hate the way scammy cryptocurrency shonk has sucked all the air out of the room on this topic, especially since most of "web3" is not even decentra…

You might be into howling at moonshots, but when it’s dark outside you need a true luminary to reflect any light back to the rest of us. Many thanks for your continued lunacy.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#182

Post by pabs3 »

e12e wrote: post #111
pabs3 wrote: post #36

Earlier quoted context omitted.

Excellent, thanks for the update. Apache isn't what I would have chosen but is reasonable enough.

Curious about this; is it the patent clause? What would you have picked - mit/bsd?

As mentioned in the issue, I would have picked a copyleft license like AGPLv3 or GPLv3.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#183

Post by trinovantes »

taftster wrote: post #161
trinovantes wrote: post #80

Earlier quoted context omitted.

I use this alias in my .ssh/config to connect through a gateway machine: Host myserver User user ProxyCommand ssh -q public-server nc -q0 private-server 22 I can't remember what these flags actually do but they seem to get the job done

ProxyJump is slightly preferred in modern SSH. Does what you're doing, but with simpler syntax. Take a look.

Thanks, I see that it's a fairly recent addition to OpenSSH

I wrote that alias about a decade ago when it wasn't available for me yet

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#184

Post by wjnc »

samhw wrote: post #160
wjnc wrote: post #103

Earlier quoted context omitted.

Contracts themselves are not articles of contract law. - This is true, but the concept of inheritance holds. 'Illegal' ~ 'against the law'. What is doing something against the law? Doing something the law states you are not allowed to do. So in practice under continental law (Napoleonic / Germanic) a law states "do X" or "leave Y" and doing the opposite is illegal. Then, if the law states "you must (under good faith)…

> Contracts themselves are not articles of contract law. - This is true, but the concept of inheritance holds. Of 'inheritance'? What does this mean? Are you trying to apply the rules of OOP to contract law, as if an individual contract were an instance of contract law...?

Yeah I was trying to make an argument the target audience might find persuasive. Inheritance is a nice concept when reasoning about (continental) contracts since a contract is only a contract if and only if it abides by contract law. That's a strict inheritance there. In truth, it's a bit more flexible: a contract could still be a contract if there are illegal provisions in the contract since at first only the illegal provisions will be scrapped by a judge.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#185

Post by mro_name »

drawfloat wrote: post #139
hotpotamus wrote: post #47

Earlier quoted context omitted.

You mean, like just login to a server without going through layers of cloud providers? How would that work? For real, I can't imagine running a straight port 22 ssh service on the modern internet, but I'm usually happy just moving it to an unprivileged port for obscurity on personal equipment (plus some other common sense hardening of course). For work stuff, I'd feel naked without some sort of VPN and it seems that'…

With passwords disabled and just using key authentication, is there a big risk of just doing a straight port 22 ssh? Genuine question, my knowledge of server security is low-to-middle.

a risk is server bugs.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#186

Post by gitowiec »

What solution is available for smartphone with Android? I would like to setup unused phone with Android system and SSH server (there are apps) to make it a standalone server connected with internet only via LTE/GSM (using simcard). I learnt that it is impossible to connect to a device using LTE connection. It's "public" IP is not so public, LTE providers have a lot of infrastructure configurations (NAT?) to not allow incoming connections initiated outside the phone. What is the best solution here? What are free for fair use (just ssh, maybe a httpd with lightweight script page), what are paid solutions. Thanks!

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#187

Post by samhw »

wjnc wrote: post #184
samhw wrote: post #160

Earlier quoted context omitted.

> Contracts themselves are not articles of contract law. - This is true, but the concept of inheritance holds. Of 'inheritance'? What does this mean? Are you trying to apply the rules of OOP to contract law, as if an individual contract were an instance of contract law...?

Yeah I was trying to make an argument the target audience might find persuasive. Inheritance is a nice concept when reasoning about (continental) contracts since a contract is only a contract if and only if it abides by contract law. That's a strict inheritance there. In truth, it's a bit more flexible: a contract could still be a contract if there are illegal provisions in the contract since at first only the illega…

> a contract is only a contract if and only if it abides by contract law

That's true, but I don't quite see how that makes a contract the law. Someone who doesn't turn up to work isn't doing something illegal by dint of breaking their employment contract. IME, 'illegal' generally refers to breaking the criminal law, whereas I wouldn't say this even breaks civil law, sensu stricto. https://malesculaw.com/is-breach-of-contract-a-tort/

Also, there's some casual discussion by lawyers of this exact terminological question here: https://www.quora.com/How-should-a-breach-of-contract-be-qua...

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#188

Post by password4321 »

jatone wrote: post #173
password4321 wrote: post #163

Earlier quoted context omitted.

I'm talking about the one-time initial setup of the Tailscale client software. Can you download and run Tailscale on a Windows client without Administrative access to install the software (setup the virtual NIC)? An SSH client is just a user-space app.

no but you also wouldn't want to allow that. just like you wouldn't want to expose a SSH socket to the world in most cases.

I have explained why I stated that 'setup of [Tailscale] typically requires administrative intervention'.

I appreciate that your approach is the more secure standard practice, yet want to make others aware of the edge cases here on a site called Hacker News rather than something like StackOverflow, where 'this is the way' reigns supreme.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#189

Post by password4321 »

aaaaaaaaata wrote: post #172
neurostimulant wrote: post #97

Earlier quoted context omitted.

I also use ZeroTier for a few years now. Very useful. Unfortunately my current ISP use NAT instead of giving their subscribers routable ip address. This means ZeroTier reverts to using an external relay when accessing my machine from outside, which is very slow and has very high latency from my country. So in addition to ZeroTier, I use AutoSSH [1] to setup and maintain a persistent ssh tunnel on a high port on my vp…

What about mosh?

>> maintain a persistent ssh tunnel

SSH agent forwarding was merged 3 months ago (after the patch waited 7+ years in one form or another), but per https://unix.stackexchange.com/a/437299 → https://github.com/mobile-shell/mosh/issues/337 (2012), mosh does not yet officially support port forwarding, despite https://github.com/mobile-shell/mosh/pull/583 (2013 → 2015 → 2017). It appears the initiator of the original patch has maintained their fork: https://github.com/rinne/mosh (disclaimer: I don't use mosh and have not tried or reviewed the differences from the official version).

Perhaps https://github.com/MisterTea/EternalTerminal is a viable alternative. Per https://github.com/MisterTea/EternalTerminal/issues/473#issu..., 'Several security teams have reviewed ET.'

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#190

Post by aaaaaaaaata »

anderspitman wrote: post #120
api wrote: post #90

Earlier quoted context omitted.

Managing expectations re:v2 has been a total failure on our part. We put far too many things in one basket. But the work is still happening. Learning moment for us: don't give timelines and don't reveal too much. Just say "when it's finished." Only Elon Musk can use Elon Time(tm). :) Edit: we also promised some things that are just brutally hard, like fully decentralizing the root backplane via full data set replicat…

FWIW your "decentralize until it hurts, then centralize until it works" is one of my favorite slogans, and I appreciate y'all making the effort.

Make sure you pay for the product/donate!
Post reply on HN