[flagged]
Excellent point; which production-grade rust ssh server would you recommend?
TinySSH is a small SSH server using NaCl, TweetNaCl
71–80 of 128 posts
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#72Cool but something i saw that was weird, this may be the first repo i've ever seen to advertise ... words of code, i've always seen secure repos advertise their "in only X LOC" seeing words of code as a metric was funny
It's unusual, but IMO makes sense, as it encapsulates complexity better than LOC do, because the latter are more sensitive to formatting preferences etc. Books are also measured in words too (also for category thresholds, e.g. between a novella and a full novel), so there's precedent too.
[deleted]
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#73tinyssh is great. One use case for it that people may not know about: using it during Linux boot so you can remotely unlock encrypted drives. I have a headless NAS server that uses dm-crypt/LUKS under ZFS. When I update my kernel/ZFS I remotely reboot the server, wait a few seconds, and then ssh into a tinyssh powered encryption key prompt to unlock the drives. (I am immediately booted from ssh, as tinyssh exits.) I…
Question: when remotely unlock the boot disk via ssh, how do you make sure the boot has not been compromised and that you are not just sending the password to the bad guys? At some point I wanted to do something with utrablue [1], to work over network rather than Bluetooth, but then it was in go and I got lazy suddenly :) [1] https://github.com/ANSSI-FR/ultrablue
What are the best options to solve this problem? It’s a hard problem imho for most threat models.
If the booting machine has been compromised and i use my usb connected keyboard to enter the full disk encryption key I would run into the exact same issues, no?
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#74tinyssh is great. One use case for it that people may not know about: using it during Linux boot so you can remotely unlock encrypted drives. I have a headless NAS server that uses dm-crypt/LUKS under ZFS. When I update my kernel/ZFS I remotely reboot the server, wait a few seconds, and then ssh into a tinyssh powered encryption key prompt to unlock the drives. (I am immediately booted from ssh, as tinyssh exits.) I…
Question: when remotely unlock the boot disk via ssh, how do you make sure the boot has not been compromised and that you are not just sending the password to the bad guys? At some point I wanted to do something with utrablue [1], to work over network rather than Bluetooth, but then it was in go and I got lazy suddenly :) [1] https://github.com/ANSSI-FR/ultrablue
TPM and checking your physical security boundary hasn't been breached.
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#75It looks like a good choice for access to small embedded devices. Except the missing port forwarding feature.
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#76tinyssh is great. One use case for it that people may not know about: using it during Linux boot so you can remotely unlock encrypted drives. I have a headless NAS server that uses dm-crypt/LUKS under ZFS. When I update my kernel/ZFS I remotely reboot the server, wait a few seconds, and then ssh into a tinyssh powered encryption key prompt to unlock the drives. (I am immediately booted from ssh, as tinyssh exits.) I…
I thought that everyone has switched to Clevis + Tang for that?
https://access.redhat.com/documentation/en-us/red_hat_enterp...
It's fully automated and supposed to be much more secure.
Has anyone got experience with it?
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#77I don't see anyone sensible replacing OpenSSH with anything else for two fundamental reasons:
1. OpenSSH has more eyes on it and more deployments than almost any other piece of non-OS/kernel software on the planet. By this stage in its life, it is very mature. Look at the vulnerability database, OpenSSH has not had a serious REMOTE vulnerability for a long time, all the recent vulnerabilities require the attacker to have some form of pre-existing host access (https://www.openssh.com/security.html).
2. OpenSSH comes from the house of OpenBSD. Those guys are serious about writing secure code and have a well-established track record. These days you can also compile OpenSSH against LibreSSL instead of OpenSSL.
Instead of replacing OpenSSH, most people would be better off spending their time switching OpenSSH to key-based-auth only and then making a few simple configuration changes to further harden OpenSSH. Starting with the config ideas proposed by Mozilla[1] and adding in options such as the built-in rate-limiting config options (PerSourceMaxStartups, PerSourceNetBlockSize and friends).
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#78tinyssh is great. One use case for it that people may not know about: using it during Linux boot so you can remotely unlock encrypted drives. I have a headless NAS server that uses dm-crypt/LUKS under ZFS. When I update my kernel/ZFS I remotely reboot the server, wait a few seconds, and then ssh into a tinyssh powered encryption key prompt to unlock the drives. (I am immediately booted from ssh, as tinyssh exits.) I…
I thought that everyone has switched to Clevis + Tang for that? https://access.redhat.com/documentation/en-us/red_hat_enterp... It's fully automated and supposed to be much more secure. Has anyone got experience with it?
> I thought that everyone has switched to Clevis + Tang for that?
Clevis+Tang is good. There's also Keylime which takes a different approach to the same[1].
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#79tinyssh is great. One use case for it that people may not know about: using it during Linux boot so you can remotely unlock encrypted drives. I have a headless NAS server that uses dm-crypt/LUKS under ZFS. When I update my kernel/ZFS I remotely reboot the server, wait a few seconds, and then ssh into a tinyssh powered encryption key prompt to unlock the drives. (I am immediately booted from ssh, as tinyssh exits.) I…
I thought that everyone has switched to Clevis + Tang for that? https://access.redhat.com/documentation/en-us/red_hat_enterp... It's fully automated and supposed to be much more secure. Has anyone got experience with it?
IIUC whether that is secure depends on your threat model. For example, how good is automated unlocking compared to unencrypted drives in a homelab setup?