Spiped – secure pipe for SSH, SMTP, etc.
tarsnap.com
Spiped – secure pipe for SSH, SMTP, etc.
1–10 of 13 posts
Re: Spiped – secure pipe for SSH, SMTP, etc.
#2Related. Others?
Spiped – symmetric, encrypted, authenticated pipes between sockets - https://news.ycombinator.com/item?id=7539499 - April 2014 (86 comments)
Re: Spiped – secure pipe for SSH, SMTP, etc.
#3> This is similar to 'ssh -L' functionality, but does not use SSH and requires a pre-shared symmetric key.
I already have SSH set up and functional, what advantage does spiped offer?
Re: Spiped – secure pipe for SSH, SMTP, etc.
#4> This is similar to 'ssh -L' functionality, but does not use SSH and requires a pre-shared symmetric key. I already have SSH set up and functional, what advantage does spiped offer?
iirc spiped uses TLS/OpenSSL for securing the connection, the symmetric key avoids the key-exchange and worrying about certificates, and therefore is better capable of efficiently using the connection than SSH by itself.
Because it's much simpler it's also a good way to expose a system to the internet, although Wireguard with a PSK is a very similar and possibly superior solution.
Re: Spiped – secure pipe for SSH, SMTP, etc.
#5> This is similar to 'ssh -L' functionality, but does not use SSH and requires a pre-shared symmetric key. I already have SSH set up and functional, what advantage does spiped offer?
I'm presuming this is pretty similar to https://www.stunnel.org
We would use stunnel rather than SSH for non-interactive usages. Having an active stunnel running all the time is safer than requiring a full SSH session being active.
Re: Spiped – secure pipe for SSH, SMTP, etc.
#6> This is similar to 'ssh -L' functionality, but does not use SSH and requires a pre-shared symmetric key. I already have SSH set up and functional, what advantage does spiped offer?
iirc spiped uses TLS/OpenSSL for securing the connection, the symmetric key avoids the key-exchange and worrying about certificates, and therefore is better capable of efficiently using the connection than SSH by itself. Because it's much simpler it's also a good way to expose a system to the internet, although Wireguard with a PSK is a very similar and possibly superior solution.
spiped does not in fact use TLS.
A subthread from 2014:
Re: Spiped – secure pipe for SSH, SMTP, etc.
#7> This is similar to 'ssh -L' functionality, but does not use SSH and requires a pre-shared symmetric key. I already have SSH set up and functional, what advantage does spiped offer?
I'm presuming this is pretty similar to https://www.stunnel.org We would use stunnel rather than SSH for non-interactive usages. Having an active stunnel running all the time is safer than requiring a full SSH session being active.
stunnel predates spiped by quite some time; spiped is a reaction to stunnel --- specifically, a network hole punch for people who trust neither OpenSSL nor OpenSSH's attack surface.
Today, most people would just use WireGuard for this.
Re: Spiped – secure pipe for SSH, SMTP, etc.
#8I posted this in response to the news that Kazakhstan is blocking Wireguard connections entirely:
Re: Spiped – secure pipe for SSH, SMTP, etc.
#9Spiped is excellent, I use it in production for really critical stuff and it's rock solid. Seriously one of the best pieces of software ever written. I've never even once had to debug a problem with it, it just works.
Re: Spiped – secure pipe for SSH, SMTP, etc.
#10I no longer have SSH listening on the bare internet on my VPS nodes .. I either place spiped in front of the standard daemon or disable it entirely and utilize Tailscale SSH