3 ms·

"KeyBox layers TLS/SSL on top of SSH and acts as a bastion host for administration. Protocols are stacked (TLS/SSL + SSH) so infrastructure cannot be exposed th

• jamiesonbecker 10y ago
  I think what he's saying is that you can't get directly to SSH, but have to go through the TLS web control panel. This seems to make an assumption that the security is equal to these two (web I/F w/ TLS plus SSH) combined in a chain, when in fact I think it now introduces a possibly weaker link. And now I'm the one making an assumption that: if you can break into KeyBox, then you have full control over the OpenSSH connection too. Ultimately it comes down to which you trust more: KeyBox or OpenSSH. (Note that this is also partly true of things that just create user accounts and sudo roles like Userify, but Userify provides a much lower degree of direct control over the remote server as opposed to a channel straight into that server. Even if you broke Userify, you'd still need to gain access to SSH, which might not even be possible from your network, and certainly all of that would show up in your logs anyway, since it's pure SSH turtles all the way down...)