Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH has no Host header

blog.exe.dev

Post reply on HN
Print view View original

101–110 of 181 posts

Re: SSH has no Host header

#101

Post by dwedge »

ulrikrasmussen wrote: post #46
otterley wrote: post #10

This is a clever trick, but I can’t help but wonder where it breaks. There seems to be an invariant that the number of backends a public key is mapped to cannot exceed the number of proxy IPs available. The scheme probably works fine if most people are only using a small number of instances, though. I assume this is in fact the case. Another thing that just crossed my mind is that the proxy IP cannot be reassigned wi…

I also wonder what happens if you want to grant access to your VM to additional public keys and one of those public keys happen to already be routed to a different VM on the same IP.

Github has a similar system and just refuses to let you addthe key if it already exists. It's hacky but it's also obviously massively widespread.

Re: SSH has no Host header

#102

Post by loktarogar »

I'm building something that has to share a pool of phone numbers for SMS between many businesses with many clients and the architecture I had planned out looks a lot like this - client gets assigned a phone number from the pool for all its interactions with a certain business.

Good write up of a tricky problem, and glad to real-world validate the solution I was considering.

Re: SSH has no Host header

#103

Post by duckerduck »

ulrikrasmussen wrote: post #48

Wouldn't a much simpler approach be to have everyone log in to a common server which sits on a VPN with all the VMs? It introduces an extra hop, but this is a pretty minor inconvenience and can be scripted away.

They kind of already have a central point with 'ssh exe.dev', which hosts the interface for provisioning new VMs. But yeah, still one extra step for the user.

Re: SSH has no Host header

#104

Post by rwmj »

_cenw wrote: post #53
miyuru wrote: post #25

> We cannot issue an IPv4 address to each machine without blowing out the cost of the subscription. We cannot use IPv6-only as that means some of the internet cannot reach the VM over the web. That means we have to share IPv4 addresses between VMs. Give a user a option for use IPv6 only, and if the user need legacy IP add it as a additional cost and move on. Trying to keep v4 at the same cost level as v6 is not a thi…

This is great if you have IPv6 support from your ISP. Not so great if you don't. Before someone mentions tunnels: Last time I tried to set up a tunnel Happy Eyeballs didn't work for me at all; almost everything went through the tunnel anyway and I had to deal with non-residential IP space issues and way too much traffic.

Are there really ISPs that don't support IPv6? I've had IPv6 from various ISPs since around 2010, and even my phone gets an IPv6 address from the cellular network.

Re: SSH has no Host header

#105

Post by jcgl »

miyuru wrote: post #25

> We cannot issue an IPv4 address to each machine without blowing out the cost of the subscription. We cannot use IPv6-only as that means some of the internet cannot reach the VM over the web. That means we have to share IPv4 addresses between VMs. Give a user a option for use IPv6 only, and if the user need legacy IP add it as a additional cost and move on. Trying to keep v4 at the same cost level as v6 is not a thi…

You could also provide a dual stack jump host. Then v4-only clients just set the ProxyJump option to get to all the v6-only hosts via the jump host.

Re: SSH has no Host header

#106

Post by rwmj »

grey-area wrote: post #54
bauruine wrote: post #28

Earlier quoted context omitted.

ssh by default sends all your public keys to a server. Yes you can limit some keys to specific hosts but it's very easy to dox yourself.

Doesn’t it try one key at a time rather than send all?

Modern sshd limits the number of retries. I have 5 or 6 keys and end up DoSing myself sometimes.

Re: SSH has no Host header

#107

Post by elric »

Two options I use:

1. Client side: ProxyJump, by far the easiest

2. Server side: use ForceCommand, either from within sshd_config or .ssh/authorized_keys, based on username or group, and forward the connection that way. I wrote a blogpost about this back in 2012 and I assume this still mostly works, but it probably has some escaping issues that need to be addressed: https://blog.melnib.one/2012/06/12/ssh-gateway-shenanigans/

Re: SSH has no Host header

#108

Post by rwmj »

cortesoft wrote: post #21
krautsauer wrote: post #12

SSH waits for the server key before it presents the client keys, right? Does this mean that different VMs from different users have the same key? (Or rather, all VMs have the same key? A quick look shows s00{1,2,3}.exe.xyz all having the same key.) So this is full MitM?

I mean, anytime you use the cloud for anything, you are giving MITM capabilities to the hosting provider. It is their hardware, their hypervisors... they can access anything inside the VMs

Not if it's using Confidential Computing. Then you're trusting "only" the CPU vendor (plus probably the government of the country where that vendor is located), but you're trusting the CPU already.

Re: SSH has no Host header

#109

Post by niobe »

I had to reread the first paragraph several times before I understood - the author was misuing a term.

> unexpected-behaviour.exe.dev

That is not a URL, that's a fully qualified domain name (FQDN), often referred to as just 'hostname'.

Re: SSH has no Host header

#110

Post by zeratax »

charcircuit wrote: post #37

You don't need SSH. Installing an SSH server to such a VM is a hold over from how UNIX servers worked. It puts you in the mindset of treating your server as a pet and doing things for a single vm instead of having proper server management in place. I would reconsider if offering ssh is an actual requirement here or if it could be better served by offering users a proper control panel to manage and monitor the vms.

what control panel is perfect for literally every type of project and has no edge cases
Post reply on HN