51–60 of 63 posts
Earlier quoted context omitted.
Didn't know about ufw, but I'm not on the same network as the RPI and don't have a static IP. And the RPI was already uploading data to an AWS instance.
Sorry, then I don’t know what you’ve meant by “lock that down AWS instances by IP”.
Earlier quoted context omitted.
You should check https://sshreach.me - zero-configuration, remote-controlled secure tunnels to your computers. I am the author of the service.
Bookmarked your page. Am building embedded devices and thought about having them keep reverse tunnels to some gateway server. Cool, that there's a dedicated service for that! Have my own domain but am still eager to outsource this part. Some things to note: - The sshReach.me logo in the topbar links to https://sshreach.me/init/default/index.html rather than https://sshreach.me . Expected the latter to have a clean UR…
- Both links lead to the same place but thanks for the advice, we will change the link on the logo.
- There are no distro specific guides because for every distro the setup is the same - just download our client script and run it. It is made to work with minimal python install and to work on every distro.
- I haven't heard of Yocto project, I will definitely look into it, thanks for the info.
At work, we have a handful of VPCs that we all work with. At the moment, we have a bastion host in every VPC. When something needs attention while on call, the engineer needs to first figure out which bastion host to ash into and then the actual work starts. I was wondering if there is a better way to setup a central bastion host with RBAC such that the attack vector is also not centralised. Does anyone here have ide…
You can use SSH Certificates, but management is kind of a pain. Not only the certs, but to do quasi-RBAC you'd need to configure the host to accept/deny certain certs for certain users to certain things, but that's still not really RBAC.
You could set up your hosts to use an LDAP server, but the LDAP server would be the central attack vector.
Honestly, Teleport is probably the only thing that provides a complete solution for what you want and more. I have tried to get my company to pay for it because it would save us so much time trying to cobble together something that's almost the same, but they balked.
This whole situation is really interesting to me. Nobody has invented a piece of technology to solve the problem we really want solved. We don't really want to "port forward through a bastion host", we want to grant specific users limited access to a private network. I think what would solve this is an SSO-authenticated Wireguard that can forward to arbitrary Wireguards - does anyone know if that's a thing?
You can also change/add them after the ssh session has started. This uses the escape mechanism. For help on that, hit return, type "~?" and hit return again. From there you will see that "~#" will list them. And "~C" takes you to a line-oriented command prompt where you can add them. For example, type return "~C", then at the prompt type "-L1234:localhost:22". Then in another window, type "telnet localhost 1234". The…
That is, hit enter, type "~C", then prompt appears, then "help" and hit enter again.
I wanted to build a TeamViewer-type system using reverse tunnels so that I could access my possibly NAT'd or dynamic IP machines from each other in a simple way. The typical use would be SSH control, copying files each way, VNC. I came up with something where each machine connects to a an always-on server with a domain name, and offers a reverse tunnel I can use to SSH down, but it occurs to me that there might be a…
Earlier quoted context omitted.
Didn't know about ufw, but I'm not on the same network as the RPI and don't have a static IP. And the RPI was already uploading data to an AWS instance.
Sorry, then I don’t know what you’ve meant by “lock that down AWS instances by IP”.
Earlier quoted context omitted.
I have been looking into SSM recently and I was a little confused by the setup instructions but after seeing your comment I read them again and I think I understand more now. I was trying to see how SSM could be used to eliminate the need for engineers to have SSH keys set up with instances. > Who should use Session Manager? > ... > Users who want to connect to an instance with just one click from the browser or AWS…
The trick is to mix SSM with EC2 Instance Connect using the `aws ec2-instance-connect send-ssh-public-key` command. We use bastions to connect to RDS instances. The bastions aren't accessible from the internet; only via SSM. You can wrap up all of the steps in a shell script that calls `ssh`, or with a bit more effort, concoct a ProxyCommand script that does everything for you and makes e.g. `ssh aws-bastion` just wo…
Earlier quoted context omitted.
The trick is to mix SSM with EC2 Instance Connect using the `aws ec2-instance-connect send-ssh-public-key` command. We use bastions to connect to RDS instances. The bastions aren't accessible from the internet; only via SSM. You can wrap up all of the steps in a shell script that calls `ssh`, or with a bit more effort, concoct a ProxyCommand script that does everything for you and makes e.g. `ssh aws-bastion` just wo…
You are starting an SSM session yet using SSH keys? Can you explain that more?
After reading this article I started a port forwarding session and can access the remote notebook without issue. All it took was the ssh port forwarding. Amazing.
If you're looking at going even deeper into SSH tunneling and port redirection, I recently made The Cyber Plumber's Handbook free: https://github.com/opsdisk/the_cyber_plumbers_handbook I made it free to the HN community a few years back [1]. There is a paid interactive lab portion (details in the repo) if you are looking for hands-on experience. Book Overview This book is packed with practical and real world example…