Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH has no Host header

blog.exe.dev

Post reply on HN
Print view View original

131–140 of 181 posts

Re: SSH has no Host header

#131

Post by rjsw »

mrjay42 wrote: post #114
rjsw wrote: post #81

Earlier quoted context omitted.

I have has native IPv6 since 2010, from two different ISPs. It is also available for one of my phone contracts but not tried enabling it yet.

Well, you're very lucky (genuinely). In 2025, I tried to access my services using IPv6 with 4G phones and different subscriptions (different ISPs), fact is, many (most?) of them did not support IPv6 at all :( I had to revert to IPv4. And really I have nothing against IPv6, but yeah, as a simple user, self hosting a bunch of services for friends and family: it was simply just not possible to use only IPv6 :( (for cont…

My phone contract that does offer IPv6 is with Free, I could not work out whether it would disable IPv4 if I enabled IPv6 so have not tried changing it.

Re: SSH has no Host header

#132

Post by apitman »

crawshaw wrote: post #128
jeroenhd wrote: post #76

Earlier quoted context omitted.

ISPs won't bother with IPv6 until they've either run out of IPv4 space or the internet starts to use IPv6's advantages. Discussions about IPv6 quickly end with "we have enough v4 space and there are no services that require v6 anyway". As long as the extra cruft for v4 support remains free or even supported, large ISPs won't care. We're at the point where people need to deal with things like peer to peer connectivity…

(exe.dev co-founder here) We are not running out of IPv4 space because NAT works. The price of IPv4 addresses has been dropping for the last year. I know this because I just bought another /22 for exe.dev for the exact thing described in this blog post: to get our business customers another 1012 VMs.

Yep. As sad as it is for p2p, NAT handles most uses cases for users, and SNI routing (or creative hacks like OP) handles most use cases for providers.

I was surprised how low IPv4 prices have gotten. Lowest since at least 2019.

Re: SSH has no Host header

#133

Post by crawshaw »

apitman wrote: post #132
crawshaw wrote: post #128

Earlier quoted context omitted.

(exe.dev co-founder here) We are not running out of IPv4 space because NAT works. The price of IPv4 addresses has been dropping for the last year. I know this because I just bought another /22 for exe.dev for the exact thing described in this blog post: to get our business customers another 1012 VMs.

Yep. As sad as it is for p2p, NAT handles most uses cases for users, and SNI routing (or creative hacks like OP) handles most use cases for providers. I was surprised how low IPv4 prices have gotten. Lowest since at least 2019.

Amazingly even most p2p works with NAT, see (and I am biased here) Tailscale.

I certainly wish we simply had more addresses. But v4 works.

Re: SSH has no Host header

#134

Post by thaumaturgy »

dwedge wrote: post #100
thaumaturgy wrote: post #38

Yeah, I ran into this problem too. I tried a few different hacky solutions and then settled on using port knocking to sort inbound ssh connections into their intended destinations. Works great. I have an architecture with a single IP hosting multiple LXC containers. I wanted users to be able to ssh into their containers as you would for any other environment. There's an option in sshd that allows you to run a script…

Doesn't this require configuration at the end user, so you could just as easily ProxyJump or use a different port? It's a nice solution but I've been looking for something more transparent (getting them to configure an SSH key is already difficult for them). A reverse proxy that selects backend based solely on the SSH key fingerprint would be ideal

That's all true, but juggling connections based on key fingerprints would also require users to have different keys for different containers -- which is good practice, but I've found that it's equally difficult for users unfamiliar with ssh to set up and properly manage more than one key, and it's equally easy for users familiar with ssh to manage multiple client configs.

That and ProxyJump both also require the container-host to negotiate ssh connections, which is... fine, I guess? But the port knocking approach means that the only thing the container-host is doing is port forwarding, which gives it like half an extra point in my calculus.

Re: SSH has no Host header

#135

Post by hnarn »

There are about 60k ports you can choose from for each IP, so I don’t understand why you can’t just give one user 1.2.3.4:1001 and the other 1.2.3.4:1002 and route that.

Setting it up like this where you just assume:

> The public key tells us the user, and the {user, IP} tuple uniquely identifies the VM they are connecting to.

Seems like begging for future architectural problems.

Re: SSH has no Host header

#136

Post by GoblinSlayer »

Host header is poorly designed builtin socks5 protocol. Use proper socks5 protocol. Its intended purpose is proxy access to inner networks, which became ubiquitous with this docker/kube/microservice thing.

Re: SSH has no Host header

#137

Post by KomoD »

CGamesPlay wrote: post #5
Eikon wrote: post #2

I am not sure to understand what this is this achieving compared to just assigning a ip + port per vm?

Using nonstandard ports would break the `ssh foo.exe.dev` pattern. This could also have been solved by requiring users to customize their SSH config (coder does this once per machine, and it applies to all workspaces), but I guess the exe.dev guys are going for a "zero-config, works anywhere" experience.

Too bad most SSH clients don't seem to support SRV records, they would've been perfect for this:

  ;; Domain:     mydomain.com.
  ;; SSH running on port 2999 at host 1.2.3.4

  ;; A Record
  vm1928.mydomain.com. 1 IN A 1.2.3.4

  ;; SRV Record
  _ssh._tcp.vm1928.mydomain.com. 1 IN SRV 0 0 2999 vm1928.mydomain.com.
If supported it would result in just being able to do "ssh vm1928.mydomain.com" without having to add "-p 1928"

Re: SSH has no Host header

#138

Post by dlenski »

dotwaffle wrote: post #30
dlenski wrote: post #3

SSH is an incredibly versatile and useful tool, but many things about the protocol are poorly designed , including its essentially made-up-as-you-go-along wire formats for authentication negotiation, key exchange, etc. In 2024-2025, I did a survey of millions of public keys on the Internet, gathered from SSH servers and users in addition to TLS hosts, and discovered—among other problems—that it's incredibly easy to m…

That's the point, though. An SSH key gives authentication, not authorization. Generally a certificate is a key signed by some other mutually trusted authority, which SSH explicitly tried to avoid.

Agreed, this makes sense in principle.

But what I found, empirically, is that a substantial number of observable SSH public keys are (re)used in way that allows a likely-unintended and unwanted determination of the owner's identities.

This consequence was likely not foreseen when SSH pubkey authentication was first developed 20-30 years ago. Certainly, the use and observability of a massive number of SSH keys on just a single servers (ssh git@github.com) wasn't foreseen.

Re: SSH has no Host header

#139

Post by dlenski »

Charon77 wrote: post #8
dlenski wrote: post #3

SSH is an incredibly versatile and useful tool, but many things about the protocol are poorly designed , including its essentially made-up-as-you-go-along wire formats for authentication negotiation, key exchange, etc. In 2024-2025, I did a survey of millions of public keys on the Internet, gathered from SSH servers and users in addition to TLS hosts, and discovered—among other problems—that it's incredibly easy to m…

What good does certificate format do? Certainly won't make people not reuse it the same way. > where the affected users might be surprised or alarmed to learn that it is possible to link these real-world identities. I feel like it's obvious that ssh public keys publically identifies me, and if I don't want that, I can make different keys for different sites.

> > where the affected users might be surprised or alarmed to learn that it is possible to link these real-world identities.

> I feel like it's obvious that ssh public keys publically identifies me, and if I don't want that, I can make different keys for different sites.

You're probably not the only one for whom it's obvious, but it appears to be not at all obvious to large numbers of users.

Re: SSH has no Host header

#140

Post by p_l »

TobTobXX wrote: post #116
rwmj wrote: post #104

Earlier quoted context omitted.

Are there really ISPs that don't support IPv6? I've had IPv6 from various ISPs since around 2010, and even my phone gets an IPv6 address from the cellular network.

Yes and it's ANNOYING. In Switzerland there is literally not one cellular network that issues IPv6 addresses. Also my workplace network (a school using some sort of Microslop solution) doesn't issue IPv6es. I have a IPv6-only VPN with some personal services. Theoretically, the data can be transported via IPv4, but Android doesn't even query AAAA records if it doesn't have a route for [::]/0. So when I'm not home, I c…

Anything Microsoft lacking V6 is configuration issue - ever since Vista, Windows networking (in corporate) treats v4-only as somewhat "degraded" configuration (some time ago there was even a funny news post about how Microsoft was forced to keep guest WiFi with enabled v4, having switched everything else to V6 only)
Post reply on HN