Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH has become our universal (Unix) external access protocol

utcc.utoronto.ca

Post reply on HN
Print view View original

51–60 of 99 posts

Re: SSH has become our universal (Unix) external access protocol

#51

Post by pphysch »

One neat feature of OpenSSH server is the AuthorizedKeysCommand config, which lets you fetch (or generate!) a user's keys from anywhere, e.g. a curl response.

With this you can easily set up a centralized SSH keys system without the pitfalls of decentralized systems or running a CA. Have the user register their public key on your website in the typical fashion, and then write a simple secure endpoint and use AuthorizedKeysCommand to instantly integrate all your OpenSSH servers.

It also lets you implement more exotic authorization schemes with the full capabilities of your internal backend, which is often a million times more enjoyable than fighting through Linux PAM.

If you use SSSD and LDAP and don't like the idea of relying on a curl every login, you can also centrally-manage the keys in LDAP for a similar effects.

Re: SSH has become our universal (Unix) external access protocol

#52

Post by jacobgkau »

whalesalad wrote: post #5

Need to get a file from one box to another? Have SSH? `scp` is your friend: https://en.wikipedia.org/wiki/SSH_File_Transfer_Protocol scp remote.host:path.txt local scp local remote.host:path Need a fast proxy to browse the internet securely and bypass restrictions without a VPN? SSH SOCKS proxy! Supported by most operating systems, but I tend to use it directly via Firefox so that it is isolated to one browser. This…

SCP (what you showed as an example) and SFTP (what you linked to a Wikipedia page for) are not the same thing. SCP is an older protocol and, while faster in some situations, is essentially abandoned. Newer versions of OpenSSH actually use SFTP even if you use the SCP command, so you might as well just use the SFTP command instead.

Re: SSH has become our universal (Unix) external access protocol

#53

Post by knowaveragejoe »

acmecorps wrote: post #41
politelemon wrote: post #10

An alternative I am seeing mentioned with some frequency is Tailscale, which doesn't need port 22 open to the internet, since it's using its own network's connectivity to facilitate your "tailscale SSH" connectivity. From what I read it's very similar to Amazon's SSM Agent. The usefulness here is that you're closing off ports and reducing your exposure, the downside is that you need proprietary agents installed on th…

Sorry, I'm new to Tailscale, but I do setup and use WireGuard. What does Tailscale offers that WireGuard doesn't if I might ask?

They've got fantastic documentation about this:

https://tailscale.com/compare/wireguard

Re: SSH has become our universal (Unix) external access protocol

#54

Post by kuschku »

acmecorps wrote: post #41
politelemon wrote: post #10

An alternative I am seeing mentioned with some frequency is Tailscale, which doesn't need port 22 open to the internet, since it's using its own network's connectivity to facilitate your "tailscale SSH" connectivity. From what I read it's very similar to Amazon's SSM Agent. The usefulness here is that you're closing off ports and reducing your exposure, the downside is that you need proprietary agents installed on th…

Sorry, I'm new to Tailscale, but I do setup and use WireGuard. What does Tailscale offers that WireGuard doesn't if I might ask?

Tailscale is just a commercial service that builds upon wireguard. It automatically generates certificates for each of your devices, ensures they're rotated and up to date, automatically configures routing and DNS between your devices and offers some additional functionality.

Tailscale has open source clients but a proprietary server to do this, but you can use the open source alternative headscale instead: https://github.com/juanfont/headscale

Re: SSH has become our universal (Unix) external access protocol

#55

Post by pxc »

juujian wrote: post #37
Sebb767 wrote: post #24

Earlier quoted context omitted.

You can also simply use `ssh -X`/`ssh -Y` and use your local X/Xwayland server for the remote app. This way you can start remote GUI apps like local ones from your shell.

How is the latency on that?

Fine if you're on the LAN, but for WAN connections you generally want xpra or NX.

Re: SSH has become our universal (Unix) external access protocol

#56

Post by jonhohle »

graemep wrote: post #40
pjs_ wrote: post #18

Drives me nuts that somewhere along the devops journey people decided that SSHing into a private server used for internal tools is an antiquated and outrageous thing to expect. People for some reason are actually excited about the prospect -- "we're gonna make it so you never have to SSH!". Little do they know that I like SSH. A lot more than I like clicking on the AWS console. And then somehow we're expected to debu…

I find it a lot easier to manage a single Linux server than multiple AWS services and a separate third party service for every single thing. Stuff built on top of AWS like Heroku is even worse. The problem is that a lot of people are now just not comfortable running things in-house. Subscribing to another service and adding an integration feels like the safe option.

That’s not always practical for performance or availability reasons.

Re: SSH has become our universal (Unix) external access protocol

#57

Post by willtemperley »

Exposing SSH to the world really bothers me. Personally I firewall to my own IP when connecting to EC2 instances, it's a pain but I don't feel comfortable knowing there may be zero days out there, plus I don't want my CPU cycles wasted by script kiddies.

It seems like there should be a better solution - something like port-knocking but done properly.

Re: SSH has become our universal (Unix) external access protocol

#58

Post by whalesalad »

jacobgkau wrote: post #52
whalesalad wrote: post #5

Need to get a file from one box to another? Have SSH? `scp` is your friend: https://en.wikipedia.org/wiki/SSH_File_Transfer_Protocol scp remote.host:path.txt local scp local remote.host:path Need a fast proxy to browse the internet securely and bypass restrictions without a VPN? SSH SOCKS proxy! Supported by most operating systems, but I tend to use it directly via Firefox so that it is isolated to one browser. This…

SCP (what you showed as an example) and SFTP (what you linked to a Wikipedia page for) are not the same thing. SCP is an older protocol and, while faster in some situations, is essentially abandoned. Newer versions of OpenSSH actually use SFTP even if you use the SCP command, so you might as well just use the SFTP command instead.

the cli command is called scp but is using sftp under the hood. tomato tomato.

Re: SSH has become our universal (Unix) external access protocol

#59

Post by sjmulder »

lucasoshiro wrote: post #45

Something that few people remember is that if you have access to a filesystem through SSH, then you can have a remote Git repository with no configuration! In the remote machine, you only need to create a bare repository: git init --bare And in your "client" machines you use it like any other remotes: git remote add my_remote my_user@my_host:path_to_repo It can be useful if for some reason you don't want to use GitHu…

Yes this is exactly how I do my private git hosting!

    ssh example.com 'git init --bare git/foo.git'
    git remote add origin example.com:git/foo.git
For other services too there are usually simple solutions like this. The low spec VPS never even sweats this way.

Re: SSH has become our universal (Unix) external access protocol

#60

Post by fragmede »

bluejekyll wrote: post #21
pjs_ wrote: post #18

Drives me nuts that somewhere along the devops journey people decided that SSHing into a private server used for internal tools is an antiquated and outrageous thing to expect. People for some reason are actually excited about the prospect -- "we're gonna make it so you never have to SSH!". Little do they know that I like SSH. A lot more than I like clicking on the AWS console. And then somehow we're expected to debu…

I think the use of IDEs really made this practice less simple. Terminal mode emacs and vi/m are simple with SSH, VSCode and other things start getting more complex. I think the extensions to VSCode and others to run remotely with a browser are starting to bring some of this back into fashion.

VScode has connect to remote server via ssh mode built in, and there's an extension to use a docker container on the server, making it pretty easy to provision dev environments for new developers.
Post reply on HN