3 ms·

VPNs will remain because of SSH, eh? https://github.com/google/huproxy https://github.com/google/huproxy

johnmaguire2013 9y ago
I think you misunderstood. My point is that you will still need direct access into the network in order to work on the BeyondCorp servers themselves, for example -- not that SSH shouldn't, or couldn't, be covered under the zero trust model as well.
- thomashabets2 9y ago
  Maybe. Are you saying that "the bootstraps" (panic access) is VPN? Why isn't the first level just an open SSH port? I'm not sure why "when all else fails" is better left a VPN port than an SSH port. I'd say SSH infrastructure (a server with only pubkey login, maybe behind TCP-MD5 and/or heavily filtered source addresses) is probably more reliable and safer than a VPN.
  - johnmaguire2013 9y ago
    With a VPN you have two security layers -- one into the network, and a second one into each individual server. They aren't mutually exclusive. Sure, you can leave SSH open publicly on WAN. I wouldn't for anything mission-critical.
    - thomashabets2 9y ago
      I did mention two other security layers, so I take issue with you counting only one. Especially since the SSH access would obviously be on a dedicated jumpgate, so that IS two just right there. Maybe running a different OS and architecture just lower risk of one zero-day piercing both. Also huproxy, or squid, or anything else that provides network-level access. But I also think that if you consider network-level access as fundamentally different from other access then that's kinda missing the point of BeyondCorp.
      - johnmaguire2013 9y ago
        > But I also think that if you consider network-level access as fundamentally different from other access then that's kinda missing the point of BeyondCorp. I understand what you're saying here. I think to me, the point is, don't trust LAN access more than WAN access. But that doesn't mean that restricting LAN access is a bad idea. One of the benefits to BeyondCorp is that you don't (generally) require LAN access in order to access resources. But if your BeyondCorp server goes down, then what? How will you access it? I probably still wouldn't want to expose my mission critical services over WAN (though I understand your point that VPN is a service exposed over WAN -- and why not SSH then?) Maybe that's wrong of me (I likely haven't given this as much thought as you), especially if you're using TCP-MD5 (which I actually haven't heard of until now, sorry for missing that), or filtering source IP addresses. This is an interesting discussion, and I really appreciate your thoughtfulness. I'd love to hear more about huproxy and how it's working for you, if you'd care to discuss it more. My email is jmaguire@duo.com.

johnmaguire2013 9y ago

I think you misunderstood. My point is that you will still need direct access into the network in order to work on the BeyondCorp servers themselves, for example -- not that SSH shouldn't, or couldn't, be covered under the zero trust model as well.

thomashabets2 9y ago
Maybe. Are you saying that "the bootstraps" (panic access) is VPN? Why isn't the first level just an open SSH port? I'm not sure why "when all else fails" is better left a VPN port than an SSH port. I'd say SSH infrastructure (a server with only pubkey login, maybe behind TCP-MD5 and/or heavily filtered source addresses) is probably more reliable and safer than a VPN.
- johnmaguire2013 9y ago
  With a VPN you have two security layers -- one into the network, and a second one into each individual server. They aren't mutually exclusive. Sure, you can leave SSH open publicly on WAN. I wouldn't for anything mission-critical.
  - thomashabets2 9y ago
    I did mention two other security layers, so I take issue with you counting only one. Especially since the SSH access would obviously be on a dedicated jumpgate, so that IS two just right there. Maybe running a different OS and architecture just lower risk of one zero-day piercing both. Also huproxy, or squid, or anything else that provides network-level access. But I also think that if you consider network-level access as fundamentally different from other access then that's kinda missing the point of BeyondCorp.
    - johnmaguire2013 9y ago
      > But I also think that if you consider network-level access as fundamentally different from other access then that's kinda missing the point of BeyondCorp. I understand what you're saying here. I think to me, the point is, don't trust LAN access more than WAN access. But that doesn't mean that restricting LAN access is a bad idea. One of the benefits to BeyondCorp is that you don't (generally) require LAN access in order to access resources. But if your BeyondCorp server goes down, then what? How will you access it? I probably still wouldn't want to expose my mission critical services over WAN (though I understand your point that VPN is a service exposed over WAN -- and why not SSH then?) Maybe that's wrong of me (I likely haven't given this as much thought as you), especially if you're using TCP-MD5 (which I actually haven't heard of until now, sorry for missing that), or filtering source IP addresses. This is an interesting discussion, and I really appreciate your thoughtfulness. I'd love to hear more about huproxy and how it's working for you, if you'd care to discuss it more. My email is jmaguire@duo.com.