Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH has no Host header

blog.exe.dev

Post reply on HN
Print view View original

81–90 of 181 posts

Re: SSH has no Host header

#81

Post by rjsw »

jeroenhd wrote: post #76
_cenw wrote: post #53

Earlier quoted context omitted.

This is great if you have IPv6 support from your ISP. Not so great if you don't. Before someone mentions tunnels: Last time I tried to set up a tunnel Happy Eyeballs didn't work for me at all; almost everything went through the tunnel anyway and I had to deal with non-residential IP space issues and way too much traffic.

ISPs won't bother with IPv6 until they've either run out of IPv4 space or the internet starts to use IPv6's advantages. Discussions about IPv6 quickly end with "we have enough v4 space and there are no services that require v6 anyway". As long as the extra cruft for v4 support remains free or even supported, large ISPs won't care. We're at the point where people need to deal with things like peer to peer connectivity…

I have has native IPv6 since 2010, from two different ISPs.

It is also available for one of my phone contracts but not tried enabling it yet.

Re: SSH has no Host header

#82

Post by binarin »

unsnap_biceps wrote: post #70
binarin wrote: post #35

In kinda the same situation, I was using username for host routing. And real user was determined by the principal in SSH certificate - so the proxy didn't even need to know the concrete certificates for users; it was even easier than keeping track of user SSH keys. Certificate signing was done by a separate SSH service, which you connected too with enabled SSH agent forwarding, pass 2FA challenge, and get a signed ce…

Can you expand on your solution a little bit? AFAIK principals don't impact the user that is logged in at all. A principal in the cert and in the authorized list just allows the user to log in as any user they want, which is why you have to write a script that validates the username before listing principals to accept. I'd love to learn more about how you solved it and what I may be mistaken about.

What I had is roughly the following: users connects via SFTP to external.website.com@my.proxy.com. Proxy server (which handles SSH protocol itself) authenticates the user using the principal, then checks whether this principal is allowed to access an external web-site and what exactly it can do here. Then proxy connects to the external website using its own secret credentials. In the end, it solved the problem of having a shared google doc with a bunch of passwords in there which everyone had access to.

Re: SSH has no Host header

#83

Post by 9dev »

Dylan16807 wrote: post #56
9dev wrote: post #49

Earlier quoted context omitted.

Asking back, when I limit the outgoing connections from a network, why would I account for any nonstandard port and make the ruleset unwieldy, just in case someone wanted to do something clever?

A simple ruleset would only block a couple dangerous ports and leave everything else connectable. Whitelisting outgoing destination ports is more complicated and more annoying to deal with for no benefit. The only place you should be whitelisting destination ports is when you're looking at incoming connections.

I definitely block outgoing ports on all our servers by default; Established connections, HTTP(S), DNS, NTP, plus infra-specific rules. There is really no legitimate reason to connect to anything else. The benefit is defence against exfiltration.

Re: SSH has no Host header

#84

Post by szszrk »

est wrote: post #66

jump servers, it's a thing and a good security measure.

And it's easy to create a clean 3 lines of ssh client config for the user to later just do

`ssh name`

Even less things to remember + you have documented your hostnames in the process.

Re: SSH has no Host header

#85

Post by 84634E1A607A »

unsnap_biceps wrote: post #59
grey-area wrote: post #54

Earlier quoted context omitted.

Doesn’t it try one key at a time rather than send all?

It does, and there's typically a maximum number of attempts (MaxAuthTries defaults to 6 IIRC) before the server just rejects the connection attempt.

Yep, but this is server-side setting. Were I a sniffer, I would set this to 10000 and now I can correlate keys.

Re: SSH has no Host header

#86

Post by grey-area »

bauruine wrote: post #74
grey-area wrote: post #54

Earlier quoted context omitted.

Doesn’t it try one key at a time rather than send all?

True but a server that wants to "deanonymize" you can just reject each key till he has all the default keys and the ones you added to your ssh agent. You can try it yourself [0] returns all the keys you send and even shows you your github username if one of the keys is used there. [0] ssh whoami.filippo.io

Nice, tried it out. This wording is incorrect though:

"Did you know that ssh sends all your public keys to any server it tries to authenticate to?"

It should be may send, because in the majority of cases it does not in fact send all your public keys.

Re: SSH has no Host header

#87

Post by fcpk »

I mean it works... but it's really ghetto. You have to handle username collisions(or enforce unique usernames). IPv4 should be non free, and that'd cover the costs...

Re: SSH has no Host header

#88

Post by ralferoo »

rjsw wrote: post #81
jeroenhd wrote: post #76

Earlier quoted context omitted.

ISPs won't bother with IPv6 until they've either run out of IPv4 space or the internet starts to use IPv6's advantages. Discussions about IPv6 quickly end with "we have enough v4 space and there are no services that require v6 anyway". As long as the extra cruft for v4 support remains free or even supported, large ISPs won't care. We're at the point where people need to deal with things like peer to peer connectivity…

I have has native IPv6 since 2010, from two different ISPs. It is also available for one of my phone contracts but not tried enabling it yet.

Conversely, I had IPv6 for about 5 years from an ISP and when I switched providers, the new ISP was IPv4 only. A few years later and they now support IPv6, but my firewall setup is now IPv4 only, so I've not bothered to update it.

Re: SSH has no Host header

#89

Post by jeroenhd »

YooLc wrote: post #51

Why not include header in the username field :) Take a look at this repo: https://github.com/mrhaoxx/OpenNG It allows you to connect multiple hosts using the same IP, for example: ssh alice+hostA@example.com -> hostA ssh alice+hostB@example.com -> hostB

I think that would work just fine for most use cases, though you may run into people trying to set up weird usernames on their VMs that conflict with the host split config.

Still, this is the best zero-config solution in my opinion, much simpler than the solution they decided to go with.

Re: SSH has no Host header

#90

Post by charcircuit »

sirl1on wrote: post #61
charcircuit wrote: post #37

You don't need SSH. Installing an SSH server to such a VM is a hold over from how UNIX servers worked. It puts you in the mindset of treating your server as a pet and doing things for a single vm instead of having proper server management in place. I would reconsider if offering ssh is an actual requirement here or if it could be better served by offering users a proper control panel to manage and monitor the vms.

Treating your server as pet may perfectly fine. Not everything has to be fully automated cloud cluster cattle.

Even as a pet I think a proper interface for managing the server would be better and more secure than ssh.
Post reply on HN