3 ms·
Are there really ssh bastions which allow arbitrary command execution? This seems dangerous. Limiting remote commands to port forwarding only will severely ham
by theamk 7y ago
Are there really ssh bastions which allow arbitrary command execution? This seems dangerous.
Limiting remote commands to port forwarding only will severely hamper this kind of attack, and will prevent ForwardAgent hacks as well.
- hackcasual 7y agoSSH bastions fall victim to feature creep like a lot of products
- steventhedev 7y agoEven if you disallow command execution on the bastion (good idea), this will still allow an attacker to pivot to servers behind the bastion. The whole point being that the strong auth (e.g. MFA) enforced by the bastion is a roadblock to pivoting.