Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH has become our universal (Unix) external access protocol

utcc.utoronto.ca

Post reply on HN
Print view View original

41–50 of 99 posts

Re: SSH has become our universal (Unix) external access protocol

#41

Post by acmecorps »

politelemon wrote: post #10

An alternative I am seeing mentioned with some frequency is Tailscale, which doesn't need port 22 open to the internet, since it's using its own network's connectivity to facilitate your "tailscale SSH" connectivity. From what I read it's very similar to Amazon's SSM Agent. The usefulness here is that you're closing off ports and reducing your exposure, the downside is that you need proprietary agents installed on th…

Sorry, I'm new to Tailscale, but I do setup and use WireGuard. What does Tailscale offers that WireGuard doesn't if I might ask?

Re: SSH has become our universal (Unix) external access protocol

#42

Post by karmakaze »

pjs_ wrote: post #18

Drives me nuts that somewhere along the devops journey people decided that SSHing into a private server used for internal tools is an antiquated and outrageous thing to expect. People for some reason are actually excited about the prospect -- "we're gonna make it so you never have to SSH!". Little do they know that I like SSH. A lot more than I like clicking on the AWS console. And then somehow we're expected to debu…

Completely agree that ssh is simpler than clicking on a web console.

A good reason for not relying on ssh is 'cattle vs pets'--using ssh administration can make snowflakes where changes aren't tracked and diagnosable/reproducible. With versioned deployment of system changes you always know how things got to be and can configure many to be the same.

Re: SSH has become our universal (Unix) external access protocol

#43

Post by yndoendo »

mdgrech23 wrote: post #23
whalesalad wrote: post #5

Need to get a file from one box to another? Have SSH? `scp` is your friend: https://en.wikipedia.org/wiki/SSH_File_Transfer_Protocol scp remote.host:path.txt local scp local remote.host:path Need a fast proxy to browse the internet securely and bypass restrictions without a VPN? SSH SOCKS proxy! Supported by most operating systems, but I tend to use it directly via Firefox so that it is isolated to one browser. This…

I don't see how this gets around a VPN? I still need a host in your example. That's what I'm paying a VPN for, a bunch of hosts around the world that are relatively fast.

Had a family member stationed overseas with the military. Bank of America chose to geo-lock IP access to their customer website. Used SSH box in the USA and informed them on how to configure their laptop to get around the restriction. No need to pay for a VPN or configure one for a single use. Ironically Bank of America had a local branch at the overseas military base.

SSH is the best network service multi-tool. From remote shell, to file transfer, to network routing.

Re: SSH has become our universal (Unix) external access protocol

#44

Post by snowfield »

bitlad wrote: post #34

Privilege Access Management platforms do unify external access protocol for SSH, k8s, databases etc. For eg. Cyberark Checkpoint harmony Teleport [ https://goteleport.com ] Strongdm [ https://www.strongdm.com/ ] Adaptive [ https://adaptive.dev/ ] and there are many other tools like these.

SSH (The company behind ssh) even have their own. https://www.ssh.com/products/privileged-access-management-pr...

I've not tested it much, but it seems very good

Re: SSH has become our universal (Unix) external access protocol

#45

Post by lucasoshiro »

Something that few people remember is that if you have access to a filesystem through SSH, then you can have a remote Git repository with no configuration!

In the remote machine, you only need to create a bare repository:

git init --bare

And in your "client" machines you use it like any other remotes:

git remote add my_remote my_user@my_host:path_to_repo

It can be useful if for some reason you don't want to use GitHub/GitLab/Bitbucket/etc or as a glorified scp

Re: SSH has become our universal (Unix) external access protocol

#46

Post by pxc »

deng wrote: post #15

That's nice and all, but as TFA already mentions, ssh has a large attack surface. The most critical one though is that you usually grant people access to a shell, so if an account gets breached, you need to worry about local root exploits, which are actually pretty common. Also, believe it or not, setting up key-based authentication is quite the challenge for a lot of people, especially if you demand encryption of th…

> However, you cannot enforce private key encryption server-side

If you could do this, how would it work?

If you could use the -sk key types or something similar with devices that are built into most computers (like TPM or the Secure Enclave) that would be nice.

> you can't even guarantee some kind of 2FA is in place. Yes, ssh does nowadays support FIDO, but that's even more complicated for users...

Can't you limit the allowable keytypes to those FIDO ones (currently ecdsa-sk and ed25519-sk)? There's also the old ChallengeResponseAuthentication stuff.

Re: SSH has become our universal (Unix) external access protocol

#47

Post by kuschku »

mdgrech23 wrote: post #23
whalesalad wrote: post #5

Need to get a file from one box to another? Have SSH? `scp` is your friend: https://en.wikipedia.org/wiki/SSH_File_Transfer_Protocol scp remote.host:path.txt local scp local remote.host:path Need a fast proxy to browse the internet securely and bypass restrictions without a VPN? SSH SOCKS proxy! Supported by most operating systems, but I tend to use it directly via Firefox so that it is isolated to one browser. This…

I don't see how this gets around a VPN? I still need a host in your example. That's what I'm paying a VPN for, a bunch of hosts around the world that are relatively fast.

VPN != VPN. You're thinking about "paid proxy for e.g. piracy", they're thinking of "tool to make computers in two different locations believe they're on the same LAN". Both are the same technology under the hood, but the use differs.

In this case you've got a network with some devices on it in location A, and a device in location B and you'd like to make B believe it's on the LAN of location A. Both a traditional VPN such as wireguard or OpenVPN and SSH with SOCKS can accomplish this.

Re: SSH has become our universal (Unix) external access protocol

#50

Post by kevincox »

glzone1 wrote: post #38

I think Amazon does a good job here. Default SSH is with certificates, passwords not used. I like that. Hard to brute force a certificates. In the old flat 10.X.X.X network amazon days - your new hosts were absolutely hammered when being brought up. There must have been folks on the amazon network itself just portscanning like crazy.

> Hard to brute force a certificates.

I see this mentioned a lot. But is it any harder to brute force a 2048 certificate than a 2048 bit password? (Note: A 2048 bit password with base64 character set is 342 characters long)

Don't get me wrong, there are many advantages to certificates (server doesn't learn the secret, easier to enforce strong secrets, ability to issue centrally, ...) but there is nothing magically different between a certificate and password when it comes to resistance to brute force. If you generate a high-entropy password you are fine from this point of view.

Post reply on HN