6 ms·

SSH Access through Cloudflare

68 points by zackbloom 8y ago

cagenut 8y ago
if its ssh why do i need to install/run cloudflared?
- LakeAustin 8y ago
  (Cloudflare team here) cloudflared proxies the traffic through the Cloudflare network to the service behind Access so that Cloudflare can ensure the request is authenticated first and then issue a token to the client through cloudflared.
  - otterley 8y ago
    sshd already has a reasonable authentication protocol (several in fact, including public keys of various kinds) that is already tunneled through an encrypted channel. What additional value does cloudflared provide? It's a bit like saying HTTPS isn't good enough, so let's tunnel HTTPS inside HTTPS -- unless I misunderstand its purpose.
    - zackbloom 8y ago
      It's because the IdPs most organizations use don't have the type of SSH flow you're talking about. For Cloudflare to authenticate you, you first have to go through your Okta, Google Apps, etc login flow which is browser-centric.
      - otterley 8y ago
        I wrote about a sensible way to provision login authentication in some detail here: https://segment.com/blog/ditching-the-shared-user/ https://segment.com/blog/ditching-the-shared-user/
        ejcx 8y ago
        There are actually quite a few aspects of your blog that I think we will emulate in the near future, with a twist, to solve more similar problems. This problem set was super different though. Adding a public facing SSH interface to our production hosts was a bit of a non-starter and we would have had to hack together auth on top of that (not just for us, but for our customers too). That's a lot of additional surface area and operational burden we didn't want. BTW we should catch up over a beer sometime =]
  - throwaway2048 8y ago
    Why not authenticate via ssh keys using the ssh client (such as the openssh -J flag)
  - cagenut 8y ago
    thanks for responding, but I confess it didn't clear anything up for me. I don't know what "Access" is or why ssh would require a token.
- antoncohen 8y ago
  Imagine you have an application like GitHub Enterprise or Phabricator, something that has a web interface and SSH for git access. You might trust SSH, but do you trust the web stack to not have vulnerabilities? I don't know about you, but I don't trust running third party apps, I won't publicly expose them. Instead I put them behind authenticating proxies, like Cloudflare Access[1], Google Identity-Aware Proxy[2], Bitly oauth2_proxy[3], and Buzzfeed SSO[4]. With an authenticating proxy an attacker can't even hit the web application until authenticating, so they can't exploit a vulnerability in the web application. They will have to pop the auth proxy first, which have less surface area, and then pop the web application. Applications that combine HTTP and SSH complicate things because the typical HTTP proxy won't proxy your SSH (git) connections, and the web authentication flow doesn't work with SSH. Cloudflare Access provides the auth proxy, cloudflared does the web authentication flow for a command line app and passes SSH traffic through Cloudflare Access. [1] https://www.cloudflare.com/products/cloudflare-access/ https://www.cloudflare.com/products/cloudflare-access/ [2] https://cloud.google.com/iap/ https://cloud.google.com/iap/ [3] https://github.com/bitly/oauth2_proxy https://github.com/bitly/oauth2_proxy [4] https://github.com/buzzfeed/sso https://github.com/buzzfeed/sso
  - otterley 8y ago
    Can you explain why this setup is better than LDAP/Ansible/Chef (to provision user accounts) + ssh keys/CA-generated certificates for ssh authentication? This setup is well known in the art and isn't rife with reported vulnerabilities. The value of using a web flow to authenticate isn't clear to me because you have to provision user accounts on Unix systems anyway to have reasonable accountability.
cremp 8y ago
Every time I see a post by Cloudflare, I get more and more nervous. Why? Because each time they introduce something, they end up at the controls. What if, if, their internal network is breached; or an unhappy employee is at the wheel? Not only would it be possible for them to use everything at their disposal, but they can start to sell user data; internal ports exposed. Considering bugs are a fact of life for developers; how long will it be until there is a big hole? Heartbleed was one; what's the next?
- m_b 8y ago
  Centralization is of course the problem here, I don't want to give more power to these corp.
- MrEldritch 8y ago
  I'm expecting Cloudflare, or something like them, to eventually become The Internet Company.
  - cagenut 8y ago
    the only reason it feels like this on HN is because cloudflare is much more focused on "retail" level marketing than the competitors. fastly is roughly the same size, akamai and edgecast are bigger than both. all of them are gnats compared to the big three cloud providers. (not counting the verizon factor w/EC)
- blattimwind 8y ago
  > Considering bugs are a fact of life for developers; how long will it be until there is a big hole? Cloudflare already had one (cloudbleed).
  - jasonvorhe 8y ago
    Come on, everyone was affected by that.
    - mikeash 8y ago
viknod 8y ago
It's amazing they are able to use local browser technology(via the popup login) to allow for using a public network as though it were private, virtually of course.
whydoineedthis 8y ago
Yeah, but are you Enterprise sales teams still a complete bag of useless dicks? Yes. Is your pricing still laughable? Yes. Is 'last decades security' still better than handing off internal network control to a third party? Yes. As usual, you only solved how to make Cloudflare more money, and not anything g technically impressive.
- apple4ever 8y ago
  Their pricing has a lot to be desired. It sounds simple with their plans, but lately they've been very nickel and dimey.
zzo38computer 8y ago
I do not want to use Cloudflare, because I will want to control it by myself, and also because Cloudflare fails to have some stuff that I would use and also it has stuff that I do not want. Also, SSH and HTTPS are not necessarily the only protocols that you might want.
rmbeard 8y ago
Will this work from China?

68 points by zackbloom 8y ago

cagenut 8y ago

if its ssh why do i need to install/run cloudflared?

LakeAustin 8y ago
(Cloudflare team here) cloudflared proxies the traffic through the Cloudflare network to the service behind Access so that Cloudflare can ensure the request is authenticated first and then issue a token to the client through cloudflared.
- otterley 8y ago
  sshd already has a reasonable authentication protocol (several in fact, including public keys of various kinds) that is already tunneled through an encrypted channel. What additional value does cloudflared provide? It's a bit like saying HTTPS isn't good enough, so let's tunnel HTTPS inside HTTPS -- unless I misunderstand its purpose.
  - zackbloom 8y ago
    It's because the IdPs most organizations use don't have the type of SSH flow you're talking about. For Cloudflare to authenticate you, you first have to go through your Okta, Google Apps, etc login flow which is browser-centric.
    - otterley 8y ago
      I wrote about a sensible way to provision login authentication in some detail here: https://segment.com/blog/ditching-the-shared-user/ https://segment.com/blog/ditching-the-shared-user/
      - ejcx 8y ago
        There are actually quite a few aspects of your blog that I think we will emulate in the near future, with a twist, to solve more similar problems. This problem set was super different though. Adding a public facing SSH interface to our production hosts was a bit of a non-starter and we would have had to hack together auth on top of that (not just for us, but for our customers too). That's a lot of additional surface area and operational burden we didn't want. BTW we should catch up over a beer sometime =]
- throwaway2048 8y ago
  Why not authenticate via ssh keys using the ssh client (such as the openssh -J flag)
- cagenut 8y ago
  thanks for responding, but I confess it didn't clear anything up for me. I don't know what "Access" is or why ssh would require a token.
antoncohen 8y ago
Imagine you have an application like GitHub Enterprise or Phabricator, something that has a web interface and SSH for git access. You might trust SSH, but do you trust the web stack to not have vulnerabilities? I don't know about you, but I don't trust running third party apps, I won't publicly expose them. Instead I put them behind authenticating proxies, like Cloudflare Access[1], Google Identity-Aware Proxy[2], Bitly oauth2_proxy[3], and Buzzfeed SSO[4]. With an authenticating proxy an attacker can't even hit the web application until authenticating, so they can't exploit a vulnerability in the web application. They will have to pop the auth proxy first, which have less surface area, and then pop the web application. Applications that combine HTTP and SSH complicate things because the typical HTTP proxy won't proxy your SSH (git) connections, and the web authentication flow doesn't work with SSH. Cloudflare Access provides the auth proxy, cloudflared does the web authentication flow for a command line app and passes SSH traffic through Cloudflare Access. [1] https://www.cloudflare.com/products/cloudflare-access/ https://www.cloudflare.com/products/cloudflare-access/ [2] https://cloud.google.com/iap/ https://cloud.google.com/iap/ [3] https://github.com/bitly/oauth2_proxy https://github.com/bitly/oauth2_proxy [4] https://github.com/buzzfeed/sso https://github.com/buzzfeed/sso
- otterley 8y ago
  Can you explain why this setup is better than LDAP/Ansible/Chef (to provision user accounts) + ssh keys/CA-generated certificates for ssh authentication? This setup is well known in the art and isn't rife with reported vulnerabilities. The value of using a web flow to authenticate isn't clear to me because you have to provision user accounts on Unix systems anyway to have reasonable accountability.

cremp 8y ago

Every time I see a post by Cloudflare, I get more and more nervous. Why? Because each time they introduce something, they end up at the controls. What if, if, their internal network is breached; or an unhappy employee is at the wheel? Not only would it be possible for them to use everything at their disposal, but they can start to sell user data; internal ports exposed. Considering bugs are a fact of life for developers; how long will it be until there is a big hole? Heartbleed was one; what's the next?

m_b 8y ago
Centralization is of course the problem here, I don't want to give more power to these corp.
MrEldritch 8y ago
I'm expecting Cloudflare, or something like them, to eventually become The Internet Company.
- cagenut 8y ago
  the only reason it feels like this on HN is because cloudflare is much more focused on "retail" level marketing than the competitors. fastly is roughly the same size, akamai and edgecast are bigger than both. all of them are gnats compared to the big three cloud providers. (not counting the verizon factor w/EC)
blattimwind 8y ago
> Considering bugs are a fact of life for developers; how long will it be until there is a big hole? Cloudflare already had one (cloudbleed).
- jasonvorhe 8y ago
  Come on, everyone was affected by that.
  - mikeash 8y ago

viknod 8y ago

It's amazing they are able to use local browser technology(via the popup login) to allow for using a public network as though it were private, virtually of course.

whydoineedthis 8y ago

Yeah, but are you Enterprise sales teams still a complete bag of useless dicks? Yes. Is your pricing still laughable? Yes. Is 'last decades security' still better than handing off internal network control to a third party? Yes. As usual, you only solved how to make Cloudflare more money, and not anything g technically impressive.

apple4ever 8y ago
Their pricing has a lot to be desired. It sounds simple with their plans, but lately they've been very nickel and dimey.

zzo38computer 8y ago

I do not want to use Cloudflare, because I will want to control it by myself, and also because Cloudflare fails to have some stuff that I would use and also it has stuff that I do not want. Also, SSH and HTTPS are not necessarily the only protocols that you might want.

rmbeard 8y ago

Will this work from China?