4 ms·
Its nice.. That said, one if the real issue is getting people to use -W ;)
by zobzu 11y ago
Its nice.. That said, one if the real issue is getting people to use -W ;)
- dijit 11y agoI'm looking at the man page, I had no idea about `-W`. However, what does this protect against that the standard: ProxyCommand ssh -q <jumpHost> nc %h 22 doesn't protect? Edit: just tried `-W` as an addition to the line but I get littlefish :: ~ » ssh pgsql3 Bad stdio forwarding specification '<jumpHost>' ssh_exchange_identification: Connection closed by remote host
- joushou 11y agosshmux gives fine-grained user controls. In the normal jumphost example, you can use ssh -W to connect to arbitrary ports and hosts on the network, poking around where you weren't intended (ssh -W is just netcat where the ssh server initiates the connection for you). With sshmux, ssh -W will only work to hosts permitted for that user, and any other request will just fail.
- keeperofdakeys 11y agoTry formatting it like this: ProxyCommand ssh jumpHost -W %h:%p -W is essentially the same as using nc, however it doesn't require executing a command on the jumphost. This project uses that fact to make the jumphost more secure (you can't execute arbitrary commands), and do destination white-listing for each user.
- zobzu 11y ago-W is just a nicer wait of doing your nc command
- joushou 11y agoThat's true. Some people complained that this isn't documented enough, so there is a wiki page for sshmuxd explaining what it does. Agent forwarding with sshmux should be safer than the general case, though, as the agent is handled in memory, rather than as a socket. The agent is also not forwarded to the destination.
- ryan-c 11y agohttps://github.com/ryancdotorg/ssh-chain https://github.com/ryancdotorg/ssh-chain should just work with this.