Making an SSH client the hard way • Hacker News Board

Re: Making an SSH client the hard way

#101

Post by dekhn » Fri, Oct 28, 2022, 3:51 PM UTC

seabrookmx wrote: post #83

dekhn wrote: post #8

Earlier quoted context omitted.

I really liked Chrome SSH extension but now I've returned to using the ssh command line client on all three platforms. The issue is wiring up the browser-hosted application with a custom network inside the browser. It's a truly interesting but highly disruptive concept and I'm curious how it will play out. Perhaps in the future every program will statically compile its own TCP stack and talk over RAW sockets, but...…

Funnily enough, the Chrome SSH extension uses pNaCl which is wasm-like in a roundabout way (non-ISA dependent bytecode running in the browser). So it's really not so different from what tailscale is doing. > Perhaps in the future every program will statically compile its own TCP stack and talk over RAW sockets A surprising number of common applications already do this. I ran into a recent bug[1] caused by a Windows u…

Yes, I know pnacl very well- I used it as a sandbox for an idle cycle harvester that ran in the background of Google servers. It was never a workable technology (even when we did heroics to make it work) although many of the ideas were good.

TLS is different from TCP. TLS support might be provided by an OS, but it's certainly something an application can link in since it's really just a byte translator with some additional complex logic. TCP is an OS-level protocol for all the reasons that history chose it (having your network device and network protocol in the same ring).

Re: Making an SSH client the hard way

#102

Post by lxgr » Fri, Oct 28, 2022, 3:59 PM UTC

blibble wrote: post #99

Serow225 wrote: post #60

Earlier quoted context omitted.

SSHuttle was created by the CEO/co-founder of Tailscale :)

that's a bit worrying there's a rather large misunderstanding on its github page: > You can't use openssh's PermitTunnel feature because it's disabled by default on openssh servers; plus it does TCP-over-TCP, which has terrible performance. it doesn't do TCP over TCP, it's a bytestream over TCP (exactly the same as shuttle) something like OpenVPN running in TCP mode would be TCP over TCP

Are you sure you are not misunderstading PermitTunnel yourself?

That SSH feature is indeed used for packet forwarding over SSH using TUN/TAP, i.e. packet-over-TCP, and by extension TCP-over-TCP.

Re: Making an SSH client the hard way

#103

Post by lxgr » Fri, Oct 28, 2022, 4:01 PM UTC

lxgr wrote: post #53

Asmod4n wrote: post #49

Earlier quoted context omitted.

And then the addon intercepts the loading of the Wasm code, injects it’s own payload into it and has access to the keys.

What keys? I think the implementation does not use regular SSH keys for SSH authentication, but rather something custom (I believe traffic to port 22 on each SSH enabled client is intercepted and the daemon handles authentication itself).

For the downvotes: Am I misunderstanding Tailscale's implementation?

I'm not commenting on whether it's a good or bad idea, but we should at least be talking about the same thing.

Re: Making an SSH client the hard way

#104

Post by dekhn » Fri, Oct 28, 2022, 4:04 PM UTC

I just learned there's a POSIX kernel in Go that can actually run apps. https://www.usenix.org/conference/osdi18/presentation/cutler

I think this should be compiled with WASM and deployed via web page. Then we can explore the idea of browser-hosted POSIX kernels.

Re: Making an SSH client the hard way

#105

Post by sedatk » Fri, Oct 28, 2022, 4:31 PM UTC

KAMSPioneer wrote: post #93

yjftsjthsd-h wrote: post #75

Earlier quoted context omitted.

If the extension in question has the read/modify all websites permission, why would it not be able to access your email or password manager?

Not OP, but...my email and password managers are not websites. I have a local app that does email, I have a local app that does password management. So the extension could certainly access passwords I put into my browser, but I don't see a vector to the "keys to the kingdom" so to speak.

The most popular password managers (1Password, Bitwarden, Lastpass) have a web UI.

Re: Making an SSH client the hard way

#106

Post by amluto » Fri, Oct 28, 2022, 6:05 PM UTC

Jarwain wrote: post #88

amluto wrote: post #23

Earlier quoted context omitted.

Hmm. If the problem is that Tailscale SSH doesn’t strongly associate the person authenticating with the connection being authenticated, asking the person to reauthenticate seems like a pretty weak solution.

Unless I'm misunderstanding something, the check solution creates that strong association. Logging in gives you a link you have to go to and auth, authing let's your session connect. Disconnect, and you have to do this again. No check mode reuses the auth of the tailscale client, check mode authenticates the ssh connection itself

And then that tailscale client is authorized to log in over ssh for however long the check lasts, and anyone else who can initiate a TCP session over the link can also get in.

Re: Making an SSH client the hard way

#107

Post by KAMSPioneer » Fri, Oct 28, 2022, 6:37 PM UTC

sedatk wrote: post #105

KAMSPioneer wrote: post #93

Earlier quoted context omitted.

Not OP, but...my email and password managers are not websites. I have a local app that does email, I have a local app that does password management. So the extension could certainly access passwords I put into my browser, but I don't see a vector to the "keys to the kingdom" so to speak.

The most popular password managers (1Password, Bitwarden, Lastpass) have a web UI.

Sure, and I use Bitwarden. I just don't use the web UI, specifically to avoid issues like malicious extensions, Firefox exploits, etc.

I'm aware that web-based email and credential managers exist, but GP asked "...why would it not be able to access your email or password manager?" I answered that, with my app choice, I don't see how they could.

Re: Making an SSH client the hard way

#108

Post by seabrookmx » Sat, Oct 29, 2022, 2:25 AM UTC

dekhn wrote: post #101

seabrookmx wrote: post #83

Earlier quoted context omitted.

Funnily enough, the Chrome SSH extension uses pNaCl which is wasm-like in a roundabout way (non-ISA dependent bytecode running in the browser). So it's really not so different from what tailscale is doing. > Perhaps in the future every program will statically compile its own TCP stack and talk over RAW sockets A surprising number of common applications already do this. I ran into a recent bug[1] caused by a Windows u…

Yes, I know pnacl very well- I used it as a sandbox for an idle cycle harvester that ran in the background of Google servers. It was never a workable technology (even when we did heroics to make it work) although many of the ideas were good. TLS is different from TCP. TLS support might be provided by an OS, but it's certainly something an application can link in since it's really just a byte translator with some addi…

Fair enough. I guess I just assumed that if the OS provided your TCP socket you'd also rely on it to provide TLS, but I'm sure I'm missing a lot of the nuance of why you'd mix and match.