Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH has no Host header

blog.exe.dev

Post reply on HN
Print view View original

171–180 of 181 posts

Re: SSH has no Host header

#171

Post by otterley »

9dev wrote: post #165
Dylan16807 wrote: post #158

Earlier quoted context omitted.

If you're allowing direct https out, how are you stopping exfiltration? Maybe https is routed through a monitoring proxy, but in the situation of allowing ssh the ssh wouldn't be going though one. So I still don't see the point of restricting outgoing ports on a machine that's allowed to ssh out .

You can't, reasonably. It's just a heuristic against many exploits using non-standard ports to avoid detection by proxies or traffic inspection utilities.

You can, but you need additional components to do it, like an SSH session broker (i.e. a gateway or proxy). Some of these, like SSH Communications' PrivX suite, can record all traffic running through the proxy. It's not all that different from HTTPS security and auditing proxies.

Re: SSH has no Host header

#172

Post by gsich »

otterley wrote: post #170
gsich wrote: post #161

Earlier quoted context omitted.

I don't because that would be impossible. Every business has different rules. But if you (as a business) want to to use this, you will find a way to make the changes to those "middleboxes". It's not your network, it's your business's network.

Large multi-national corporations, by way of their sheer size, tend to force their vendors to bend towards their needs, not to adapt to meet their vendors' unusual networking requirements.

Thankfully SSH on non-22 is not unusual.

Re: SSH has no Host header

#175

Post by amtamt »

dwedge wrote: post #98

This is a problem I've come up against a few times. Enforcing a different key per server would also help solve it in their case, but really I just want a haproxy plugin that allows selecting a backend based on the public key

Since 2020, based on hostname, routing is possible to different ssh backends

https://www.haproxy.com/blog/route-ssh-connections-with-hapr...

from the blog

> Did you know that you can proxy SSH connections through HAProxy and route based on hostname?

Re: SSH has no Host header

#176

Post by otterley »

gsich wrote: post #172
otterley wrote: post #170

Earlier quoted context omitted.

Large multi-national corporations, by way of their sheer size, tend to force their vendors to bend towards their needs, not to adapt to meet their vendors' unusual networking requirements.

Thankfully SSH on non-22 is not unusual.

Of all the SSH servers in the world, what percentage are listening on a port other than 22? To answer this question, you can visit https://data-status.shodan.io/ports.html and see for yourself.

By "unusual," I literally mean "not usual/not typical." Not "never happens."

Re: SSH has no Host header

#177

Post by gsich »

otterley wrote: post #176
gsich wrote: post #172

Earlier quoted context omitted.

Thankfully SSH on non-22 is not unusual.

Of all the SSH servers in the world, what percentage are listening on a port other than 22? To answer this question, you can visit https://data-status.shodan.io/ports.html and see for yourself. By "unusual," I literally mean "not usual/not typical." Not "never happens."

I fail to see how this is relevant.

Re: SSH has no Host header

#178

Post by otterley »

gsich wrote: post #177
otterley wrote: post #176

Earlier quoted context omitted.

Of all the SSH servers in the world, what percentage are listening on a port other than 22? To answer this question, you can visit https://data-status.shodan.io/ports.html and see for yourself. By "unusual," I literally mean "not usual/not typical." Not "never happens."

I fail to see how this is relevant.

I'll explain it once again, then leave this thread:

Companies frequently put egress network policies in place that confine certain protocols like SSH and HTTP to certain ports. They do this in order to achieve compliance with regulations, to achieve security or operational certifications, or simply because they're paranoid. It's not necessarily the least restrictive means of accomplishing their goals, but that's what they do. And if they're big enough, they're going to use the size of the deal and their brand equity to persuade their vendors, who might ordinarily prefer to offer a service on a nonstandard port, to provide it on the customer's preferred port instead.

If you still don't understand, I'm sorry, but I cannot assist further.

Re: SSH has no Host header

#179

Post by gsich »

otterley wrote: post #178
gsich wrote: post #177

Earlier quoted context omitted.

I fail to see how this is relevant.

I'll explain it once again, then leave this thread: Companies frequently put egress network policies in place that confine certain protocols like SSH and HTTP to certain ports. They do this in order to achieve compliance with regulations, to achieve security or operational certifications, or simply because they're paranoid. It's not necessarily the least restrictive means of accomplishing their goals, but that's what…

Companies might do that. They have the right to do so. If they still want to use that service, they will find a way to use it. Be it by vendor-coercing or simpler methods.

Just because those companies exist, does not mean that their shitty practices have any imapct on real internet connections. If you as a paying ISP customer want to use a custom port or whatever, it is going to work. So you as a developer don't have any restriction (which you don't know anyway beforehand) if you are developing a solution for a problem.

"Middleboxes" is a hackernews meme that is thrown around because people here work at places who restrict stuff and they can't bother to change that situation but instead complain about it.

The fact that games exist and they use all kind of ports is proof that this is not a problem for normal networks.

Re: SSH has no Host header

#180

Post by xingped »

znpy wrote: post #168
crawshaw wrote: post #127

Earlier quoted context omitted.

(exe.dev co-founder here) IPv6 does not work on the only ISP in my neighborhood that provides gigabit links. I will not build a product I cannot use. Even when IPv6 is rolled out, it is only tested for consumer links by Happy Eyeballs. Links between DCs are entirely IPv4 even when dual stacked. We just discovered 20 of our machines in an LAX DC have broken IPv6 (because we tried to use Tailscale to move data to them,…

> IPv6 does not work on the only ISP in my neighborhood that provides gigabit links. I will not build a product I cannot use. Cool. Somebody else will, and will likely have a better price (due to the abundance of ipv6 addresses) and you’ll go out of business. > because we tried to use Tailscale to move data to them, which defaults to happy eyeballs Not gonna lie, to me that reads like “because we don’t know how to us…

Whenever I see a comment that says "if you don't do the thing in the most efficient way possible, someone else will steal your lunch", I think that people vastly overestimate the likelihood that this will actually happen.

It's similar to "open source is the most secure because it has the most eyeballs on it", but in reality security bugs will exist for years with no one noticing because people vastly overestimate how any developers will actually spend their time analyzing any given open source software.

Sure, bugs are more likely to be caught in open source and it's more likely someone will take your market share with a more efficient and competitively priced product, but you're overblowing the likelihood of both by a large margin.

Post reply on HN