What makes this any better than say, MOSH?
SSH3: SSHv2 using HTTP/3 and QUIC
111–120 of 206 posts
Re: SSH3: SSHv2 using HTTP/3 and QUIC
#112Oauth for ssh sounds annoying
Re: SSH3: SSHv2 using HTTP/3 and QUIC
#113Earlier quoted context omitted.
It sure would be nice to be able to easily throw up a CDN like Cloudflare in front of my ssh server with no client side special sauce required. I didn't see it stated in the documentation, it this feels like something that might work for that setup.
Why are people obsessed with implanting CloudFlare right in the middle of everything they do? There is absolutely nobody that needs DDoS for their SSH server. I get that CloudFlare has been a well behaved netizen so far, but let's be real, it won't last forever. It never does. Eventually the shareholders start turning the screws and CloudFlare is going to succumb to the same pressures every company does and they're g…
Every personal blog is low traffic until it lands at the top of HN
Re: SSH3: SSHv2 using HTTP/3 and QUIC
#114Earlier quoted context omitted.
Why are people obsessed with implanting CloudFlare right in the middle of everything they do? There is absolutely nobody that needs DDoS for their SSH server. I get that CloudFlare has been a well behaved netizen so far, but let's be real, it won't last forever. It never does. Eventually the shareholders start turning the screws and CloudFlare is going to succumb to the same pressures every company does and they're g…
Every personal blog is low traffic until it lands at the top of HN
Which still means that the HTTP-server can be behind CloudFlare, but nobody accesses your blog through SSH (hence not necessary to put it behind CloudFlare).
Re: SSH3: SSHv2 using HTTP/3 and QUIC
#115SSH over QUIC would be nice. I don't see any advantage of layering HTTP/3 here. It adds more friction, and the only advantage it brings is being able to "hide" the SSH server over a URL path. I guess x.509 certificates would be fine, but SSH hostkeys, SSHFP or TOFU is enough and far more secure (because it implicitly pins the server public key). It's a relatively new project from the looks of it, so I'd definitely no…
In the 90s it was commonplace to design a new protocol on top of TCP/IP. These days, all the tooling and infrastructure is for HTTP. Designing a new protocol, you'd be starting from scratch; HTTP is much, much easier to build an application on top of.
Re: SSH3: SSHv2 using HTTP/3 and QUIC
#116Earlier quoted context omitted.
It sure would be nice to be able to easily throw up a CDN like Cloudflare in front of my ssh server with no client side special sauce required. I didn't see it stated in the documentation, it this feels like something that might work for that setup.
Why are people obsessed with implanting CloudFlare right in the middle of everything they do? There is absolutely nobody that needs DDoS for their SSH server. I get that CloudFlare has been a well behaved netizen so far, but let's be real, it won't last forever. It never does. Eventually the shareholders start turning the screws and CloudFlare is going to succumb to the same pressures every company does and they're g…
Why would you intentionally MITM your SSH connection?
Re: SSH3: SSHv2 using HTTP/3 and QUIC
#117This is pretty neat, definitely better to move to UDP, so that we can have the proper response to unauthorized contact--no response. QUIC is fine as is though, no need to layer HTTP3 on top of it.
The reason they’re using HTTP is to allow for hiding the SSH server so that it pretends to be a dummy HTTP server that responds to 404 on all requests unless you know the special random URL that hosts the SSH capabilities. It’s a neat idea but overkill when you’re not using that capability (didn’t dig into the code so maybe it is bypassed if you don’t ask for a secret URL). It does make me hesitant as I don’t know ho…
It's not exactly the same but you can "hide" a ssh server on port 443 with haproxy
It's not really hidden as if you initiate a connection with ssh it will reveal itself, but if you try https it will reply as a webserver
It world by looking at the first few bytes and deciding what to do based on that
At one point I was running https/ssh/openvpn/custom-tcp all on one port..
Here is someone else explaining how to do it, I don't think I ever wrote it up
Re: SSH3: SSHv2 using HTTP/3 and QUIC
#118This is not related to OpenSSH or the RFCs for SSH3 published by IETF. It is just someone's random project.
It still seems like a nice experiment if nothing else. If only it was done in rust ;)
Re: SSH3: SSHv2 using HTTP/3 and QUIC
#119Seems cool but mosh already exists
Re: SSH3: SSHv2 using HTTP/3 and QUIC
#120Earlier quoted context omitted.
The reason they’re using HTTP is to allow for hiding the SSH server so that it pretends to be a dummy HTTP server that responds to 404 on all requests unless you know the special random URL that hosts the SSH capabilities. It’s a neat idea but overkill when you’re not using that capability (didn’t dig into the code so maybe it is bypassed if you don’t ask for a secret URL). It does make me hesitant as I don’t know ho…
It's not exactly the same but you can "hide" a ssh server on port 443 with haproxy It's not really hidden as if you initiate a connection with ssh it will reveal itself, but if you try https it will reply as a webserver It world by looking at the first few bytes and deciding what to do based on that At one point I was running https/ssh/openvpn/custom-tcp all on one port.. Here is someone else explaining how to do it,…
I never even thought of that, atlassian has a page on it: https://confluence.atlassian.com/bitbucketserver/setting-up-...