Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH3: SSHv2 using HTTP/3 and QUIC

github.com

Post reply on HN
Print view View original

81–90 of 206 posts

Re: SSH3: SSHv2 using HTTP/3 and QUIC

#81

Post by magicalhippo »

gchamonlive wrote: post #50
nixgeek wrote: post #47

Earlier quoted context omitted.

I don’t think this is SSHv2 though the GitHub talks about reimplementation on HTTP semantics, and the paper illustrates SSHv2 vs SSH3 as being extremely different for session setup. In naming; Francois also explains SSH3 is a concatenation of SSH and HTTP/3 — we can not like that here on HN (due seemingly to the lack of IETF involvement?) but it’s what the project creators picked.

Would SSHTTP3 have been more adequate for the project's name?

SHT3 as in SSH over HTTP3

Re: SSH3: SSHv2 using HTTP/3 and QUIC

#82

Post by Ayesh »

mkesper wrote: post #54
Ayesh wrote: post #46

SSH over QUIC would be nice. I don't see any advantage of layering HTTP/3 here. It adds more friction, and the only advantage it brings is being able to "hide" the SSH server over a URL path. I guess x.509 certificates would be fine, but SSH hostkeys, SSHFP or TOFU is enough and far more secure (because it implicitly pins the server public key). It's a relatively new project from the looks of it, so I'd definitely no…

Ssh hostkeys offer no solution for first connect to ephemeral hosts.

Strict SSHFP can theoretically solve it [1], assuming it's used in the first place and has DNSSEC. I personally use it for all servers I manage purely because I like the additional security, but it not at all common and DNSSEC isn't all that perfect either.

[1] https://aye.sh/blog/sshfp-verification

Re: SSH3: SSHv2 using HTTP/3 and QUIC

#83

Post by oarsinsync »

password4321 wrote: post #55
PrimeMcFly wrote: post #42

Earlier quoted context omitted.

Why would you tunnel WireGuard over SSH?

Although not relevant to my post above, tunneling WireGuard over SSH sounds like an interesting challenge... Because WireGuard and SSH are at different layers of the network stack, it might be necessary (though slow) to bridge two WireGuard networks through a single TCP socket port-forwarded by SSH. I'm actually curious now what tools would best be used to accomplish this, how much effort would be needed to configure…

> I'm actually curious now what tools would best be used to accomplish this

“Tunnel UDP over SSH”

https://superuser.com/questions/53103/udp-traffic-through-ss... has some suggestions

Re: SSH3: SSHv2 using HTTP/3 and QUIC

#84

Post by HeckFeck »

adontz wrote: post #34

I believe security models for HTTP and SSH are pretty different. HTTP is usually public and anonymous, SSH is usually private and authenticated. While QUIC is definitely a great technology for HTTP use case, I'm not so sure about SSH. Not saying it's not, just it's something to reason about. For example x509 seems to be a disadvantage to me. I do not want anyone with a cheap DigiCert certificate be able to log in to…

> Who does new protocols these days?

My business brain understands why, but my engineer’s heart laments.

Re: SSH3: SSHv2 using HTTP/3 and QUIC

#86

Post by jhatemyjob »

So let me get this straight, from reading the README, the only tangible benefit is faster session establishment? With the downsides being, he's using a more complicated protocol, which apparently has slower throughput?? I guess this is a cool experiment but why would anyone use this over OpenSSH or libssh2?

Re: SSH3: SSHv2 using HTTP/3 and QUIC

#87

Post by wmf »

georgyo wrote: post #31

People are being perhaps a little too over dramatic here. Yes, this is not SSHv3 as defined by a standards body. It is very much SSHv2 over HTTP/3. (Which sorta sounds like how HTTP/3 is actually HTTP/2 over QUIC) But there is lots of SSH servers and clients, such as Dropbear SSH, OpenSSH, libssh, libssh2 (which is very different from libssh which also supports sshv2), and more. So I don't blame the creators from put…

I think something like QSH (QUIC shell) might be a better name.

Re: SSH3: SSHv2 using HTTP/3 and QUIC

#88

Post by okasaki »

qingcharles wrote: post #80
okasaki wrote: post #71

Earlier quoted context omitted.

You can run different hosts on one web server, like company.com goes to localhost:5555 (your app or whatever) and ssh.company.com goes to localhost:8443 (let's say you're running ssh3 on that port)

* depending on your web server/reverse proxy configuration [for instance, I run Kestrel and it really isn't designed to target more than one site; I do it, but it's like bending that Lego brick to make it fit where it shouldn't go]

Yes I suppose, although you can always put a web server that does support it (like nginx) in front of your web server that doesn't support it.

Re: SSH3: SSHv2 using HTTP/3 and QUIC

#90

Post by amluto »

the8472 wrote: post #21
amluto wrote: post #5

Earlier quoted context omitted.

What does “official” mean? The OpenSSH team? IETF? Anyway, SSH authentication is extremely inflexible, and the protocol is not particularly performant, especially on large bandwidth-delay links. Moving to HTTP3 seems like an excellent idea if it’s implemented well. (Although… we really need a way to do TLS/QUIC to an endpoint without a domain name.)

> (Although… we really need a way to do TLS/QUIC to an endpoint without a domain name.) Generate self-signed cert, let the client TOFU. And skip the HTTP part. Just like SSH. There's no reason to do things like a browser.

I think we could do much better than this with a small amount of creativity.

But it really ought to be possible to securely configure locally-connected devices with a browser, and this is not really possible today.

Post reply on HN