Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH has become our universal (Unix) external access protocol

utcc.utoronto.ca

Post reply on HN
Print view View original

71–80 of 99 posts

Re: SSH has become our universal (Unix) external access protocol

#71

Post by fragmede »

acmecorps wrote: post #41
politelemon wrote: post #10

An alternative I am seeing mentioned with some frequency is Tailscale, which doesn't need port 22 open to the internet, since it's using its own network's connectivity to facilitate your "tailscale SSH" connectivity. From what I read it's very similar to Amazon's SSM Agent. The usefulness here is that you're closing off ports and reducing your exposure, the downside is that you need proprietary agents installed on th…

Sorry, I'm new to Tailscale, but I do setup and use WireGuard. What does Tailscale offers that WireGuard doesn't if I might ask?

Convenience. you're free to run wireguard yourself, but that's a lot of faffing about with config files that some people don't want to do. and then on top of that, they have clients for mobile and eg AppleTV. that may be outside your use case, but some find it handy.

Re: SSH has become our universal (Unix) external access protocol

#72

Post by fragmede »

nonrandomstring wrote: post #32
sargun wrote: post #22

I wish that SSH would be disaggregated further. SSH has become the suite du jour for file transfer, remote access, and a handful of other things. Unfortunately, simultaneously, innovations have been made in transport protocols and elsewhere in the stack that we're unable to take advantage of. SFTP is a great example of a protocol which has a discrete server (look! There's sftp-server on your computer. Nothing prevent…

These are good asks. After xz I worry a little about how many eggs are in the ssh basket.

xz? regreSSHion should make you lose sleep!

https://arstechnica.com/security/2024/07/regresshion-vulnera...

Re: SSH has become our universal (Unix) external access protocol

#73

Post by sdenton4 »

imiric wrote: post #66
pjs_ wrote: post #18

Drives me nuts that somewhere along the devops journey people decided that SSHing into a private server used for internal tools is an antiquated and outrageous thing to expect. People for some reason are actually excited about the prospect -- "we're gonna make it so you never have to SSH!". Little do they know that I like SSH. A lot more than I like clicking on the AWS console. And then somehow we're expected to debu…

Not wanting to use SSH has nothing to do with not liking it. It's about getting your infrastructure to a state where everything you need to manage and troubleshoot it can be done _without_ SSH. This doesn't mean replacing it with click-ops, but having robust deployment and automation in place, an external and centralized log/metrics store, and everything else that minimizes the need to manually manage it at all. Addi…

Doesn't it just move the targets?

We also have to deal with ridiculously complex permissions structures in cloud dashboards. This is also an operational burden, and certainly a security burden if you get it wrong...

Re: SSH has become our universal (Unix) external access protocol

#74

Post by cm2187 »

rsync wrote: post #63
cm2187 wrote: post #6

What about an IP whitelist managed on some other website (say in AWS). If you need remote access while you are travelling, you login to that website, which will add your current IP to the whitelist. The server refreshes its firewall with the new whitelist every 5 minutes. So within 5 minutes you get access. That creates another layer of protection (authentication to the website). I would assume a linux firewall is ve…

There is no reason to bother with any of this when you can just hide behind port knocking.

I didn't know that existed. Seems like a good alternative, thanks. I prefer the whitelist for my own personal usage as it applies to all my servers/VM in one go for all ports. But agree that's a simpler solution if you have a single port+machine to protect.

Re: SSH has become our universal (Unix) external access protocol

#75

Post by cm2187 »

themoonisachees wrote: post #17
cm2187 wrote: post #6

What about an IP whitelist managed on some other website (say in AWS). If you need remote access while you are travelling, you login to that website, which will add your current IP to the whitelist. The server refreshes its firewall with the new whitelist every 5 minutes. So within 5 minutes you get access. That creates another layer of protection (authentication to the website). I would assume a linux firewall is ve…

Apart from the complexities added by having to build this in the first place, this works, but requires a desktop environment, which is not true of ssh. You could make the argument that this could be an off-the-shelf product you simply install, but then the default port for it because as big of a target as port 22 as soon as it becomes commonplace enough, except you don't have 20+ years of open-source security researc…

Agree but even if you compromise the white list, you still need to get over ssh's own security, so I see that as adding another lock rather than substituting it, and mostly as a protection against someone scanning the IP address space when a new unpatched zero day surfaces.

As for the desktop environment, you can add an API to the website.

Re: SSH has become our universal (Unix) external access protocol

#76

Post by imiric »

sdenton4 wrote: post #73
imiric wrote: post #66

Earlier quoted context omitted.

Not wanting to use SSH has nothing to do with not liking it. It's about getting your infrastructure to a state where everything you need to manage and troubleshoot it can be done _without_ SSH. This doesn't mean replacing it with click-ops, but having robust deployment and automation in place, an external and centralized log/metrics store, and everything else that minimizes the need to manually manage it at all. Addi…

Doesn't it just move the targets? We also have to deal with ridiculously complex permissions structures in cloud dashboards. This is also an operational burden, and certainly a security burden if you get it wrong...

The idea is to reduce the burden and simplify operations. You likely already need cloud dashboards for other things, and you really can't avoid that. You also can't remove SSH without improving automation, but once you do, you'll realize you simply don't need SSH at all.

A sibling comment mentioned cattle vs pets, which is related to this. If servers are not valuable, can be quickly recreated, and the infrastructure is self-healing, that means that you've done all the hard work, and don't need SSH for taking care of your pets.

Re: SSH has become our universal (Unix) external access protocol

#77

Post by deknos »

pjs_ wrote: post #18

Drives me nuts that somewhere along the devops journey people decided that SSHing into a private server used for internal tools is an antiquated and outrageous thing to expect. People for some reason are actually excited about the prospect -- "we're gonna make it so you never have to SSH!". Little do they know that I like SSH. A lot more than I like clicking on the AWS console. And then somehow we're expected to debu…

it's just a bit sad that there was never a proper port knocking protocol established, which had features and was provably secure in theory and implementation, than no one would have issues de/activating ssh per on need-basis

Re: SSH has become our universal (Unix) external access protocol

#78

Post by ASalazarMX »

whalesalad wrote: post #65
dspillett wrote: post #62

Earlier quoted context omitted.

> Need to get a file from one box to another? Have SSH? `scp` is your friend For less trivial transfers (recursive structures, large collections that you want to sync with minimal time) rsync supports SSH as a transport medium out of the box so scp remote.host:path.txt local scp local remote.host:path becomes rsync remote.host:path.txt local rsync local remote.host:path for the basics, then start adding the other opt…

I must admit my rsync experience is limited. I do not know the behaviors and flags very deeply. It's on my list though, as it's surely another one of those foundational linux tools. I know it is even faster than cp on the same host for some situations.

rsync is the tar of network transfers. It is extremely useful, but has too many options, so one ends up memorizing a few use cases and carefully sticking to them.

I still have PTSD from the time I played with the options and made the mistake of swapping source and destination, where the destination was a blank disk.

Re: SSH has become our universal (Unix) external access protocol

#79

Post by fragmede »

pphysch wrote: post #51

One neat feature of OpenSSH server is the AuthorizedKeysCommand config, which lets you fetch (or generate!) a user's keys from anywhere, e.g. a curl response. With this you can easily set up a centralized SSH keys system without the pitfalls of decentralized systems or running a CA. Have the user register their public key on your website in the typical fashion, and then write a simple secure endpoint and use Authoriz…

A popular website for that is GitHub.com.

My public key is at http://GitHub.com/fragmede.keys, so anyone wanting to let me on their server can just create me an account, stick that in ~/.ssh/authorized_keys, tell me an IP address and port number, and I'm in.

Re: SSH has become our universal (Unix) external access protocol

#80

Post by devman0 »

cm2187 wrote: post #6

What about an IP whitelist managed on some other website (say in AWS). If you need remote access while you are travelling, you login to that website, which will add your current IP to the whitelist. The server refreshes its firewall with the new whitelist every 5 minutes. So within 5 minutes you get access. That creates another layer of protection (authentication to the website). I would assume a linux firewall is ve…

This is what I do for my own network, but with DNS instead of a website.

I have a cron job that reads a DNS A/AAAA record every 5 minutes or so, and updates an ipset referred to by an iptable (now nftable) rule.

So I log in to my DNS provider's dash and update the record to my current IP address (I could automate this part too, but I'm lazy)

Post reply on HN