SSH is great but rapidly becomes less so once companies decide to put their servers behind some times cascaded SSH gateways, so you need to know which magic invocation of jump hosts to put in to have your connection go through anyway.
SSH has become our universal (Unix) external access protocol
31–40 of 99 posts
Re: SSH has become our universal (Unix) external access protocol
#32I wish that SSH would be disaggregated further. SSH has become the suite du jour for file transfer, remote access, and a handful of other things. Unfortunately, simultaneously, innovations have been made in transport protocols and elsewhere in the stack that we're unable to take advantage of. SFTP is a great example of a protocol which has a discrete server (look! There's sftp-server on your computer. Nothing prevent…
These are good asks. After xz I worry a little about how many eggs are
in the ssh basket.
Re: SSH has become our universal (Unix) external access protocol
#33I often find out that SSH is blocked in a lot of networks. This is frustrating, since I usually clone git repositories trough SSH (and I'm considering for this reason switching to HTTPS), since I find stupid having to use a VPN just to work with git.
If you really want to have something that gives you access to remote resources in any network the only solution is to use a VPN over TLS on the port 443, to make it impossible to distinguish it from any other normal HTTPS traffic. This is the reason why I run an OpenVPN server at my company, where normally I use Wireguard that is more performant (but it's blocked in a lot of networks).
At the end of the day port 443 with TLS traffic on it is the only thing that is guaranteed to not have been blocked (on port 80, 25, etc firewalls may check that you are effectively transferring HTTP traffic, they could not on 443 since the traffic is encrypted, tough a smart firewall can assume from traffic patterns that the connection is unlikely HTTPS, to this day I've jet to se a firewall this smart).
Re: SSH has become our universal (Unix) external access protocol
#34Privilege Access Management platforms do unify external access protocol for SSH, k8s, databases etc.
For eg.
Cyberark
Checkpoint harmony
Teleport [https://goteleport.com]
Strongdm [https://www.strongdm.com/]
Adaptive [https://adaptive.dev/]
and there are many other tools like these.
Re: SSH has become our universal (Unix) external access protocol
#35An alternative I am seeing mentioned with some frequency is Tailscale, which doesn't need port 22 open to the internet, since it's using its own network's connectivity to facilitate your "tailscale SSH" connectivity. From what I read it's very similar to Amazon's SSM Agent. The usefulness here is that you're closing off ports and reducing your exposure, the downside is that you need proprietary agents installed on th…
It's a proprietary network but not proprietary agents (except the bits specific to proprietary platforms). One handy feature this enabled is that you can include their open source go library in your program and avoid needing to install anything besides your own binary.
Isn't there even an open implementation of the network/coordination layer (Headscale)?
But regardless, the best term I've heard for these types of networks is overlays. You can add "zero trust" or whatever to make it seem more fashionable, or VPN if you're old school. I remember using Hamachi for this type of use back in maybe the early aughts.
Re: SSH has become our universal (Unix) external access protocol
#36I often find out that SSH is blocked in a lot of networks. This is frustrating, since I usually clone git repositories trough SSH (and I'm considering for this reason switching to HTTPS), since I find stupid having to use a VPN just to work with git. If you really want to have something that gives you access to remote resources in any network the only solution is to use a VPN over TLS on the port 443, to make it impo…
Re: SSH has become our universal (Unix) external access protocol
#37Earlier quoted context omitted.
Ahh, good times. SSH tunnels and FoxyProxy to run X11 applications on remote servers.
You can also simply use `ssh -X`/`ssh -Y` and use your local X/Xwayland server for the remote app. This way you can start remote GUI apps like local ones from your shell.
How is the latency on that?
Re: SSH has become our universal (Unix) external access protocol
#38I think Amazon does a good job here.
Default SSH is with certificates, passwords not used. I like that. Hard to brute force a certificates.
In the old flat 10.X.X.X network amazon days - your new hosts were absolutely hammered when being brought up. There must have been folks on the amazon network itself just portscanning like crazy.
Re: SSH has become our universal (Unix) external access protocol
#39Drives me nuts that somewhere along the devops journey people decided that SSHing into a private server used for internal tools is an antiquated and outrageous thing to expect. People for some reason are actually excited about the prospect -- "we're gonna make it so you never have to SSH!". Little do they know that I like SSH. A lot more than I like clicking on the AWS console. And then somehow we're expected to debu…
I think the use of IDEs really made this practice less simple. Terminal mode emacs and vi/m are simple with SSH, VSCode and other things start getting more complex. I think the extensions to VSCode and others to run remotely with a browser are starting to bring some of this back into fashion.
Connecting over SSH with VSCode is the most convenient SSH experience I've ever had: VSCode runs locally, connects via SSH and makes it feel like I'm working locally. I can edit files, open terminals, run software, etc. It's like running vim, a couple terminals and a scp file manager, but with the convenience of a desktop application
Technically you need an extension (Remote - SSH) but I think that's installed by default. It runs some remote code on the server to make it more seamless, but that has never gotten in the way.
Re: SSH has become our universal (Unix) external access protocol
#40Drives me nuts that somewhere along the devops journey people decided that SSHing into a private server used for internal tools is an antiquated and outrageous thing to expect. People for some reason are actually excited about the prospect -- "we're gonna make it so you never have to SSH!". Little do they know that I like SSH. A lot more than I like clicking on the AWS console. And then somehow we're expected to debu…
I find it a lot easier to manage a single Linux server than multiple AWS services and a separate third party service for every single thing. Stuff built on top of AWS like Heroku is even worse.
The problem is that a lot of people are now just not comfortable running things in-house. Subscribing to another service and adding an integration feels like the safe option.