3 ms·

It's often used as a reverse proxy and static file server, but oh, so much more is possible. Today, if you're using HTTPS, you should almost certainly be using

by mholt 7y ago

It's often used as a reverse proxy and static file server, but oh, so much more is possible. Today, if you're using HTTPS, you should almost certainly be using Caddy. Maybe tomorrow if you need to set up a memory-safe SSH server, you could be using Caddy. (Just an example.)

chris_st 7y ago
Sorry for the stupid question, but what is a "memory-safe SSH server"? Thanks!
- mholt 7y ago
  Not a stupid question, it's not a phrase you hear very often because there isn't... really... one... at all. (Not in mainstream use AFAIK?) Memory safety is a class of guarantees certain software offers you against certain vulnerabilities. Software written in C is generally considered "memory unsafe" since it's hard to write correct C code when managing with memory, so it's easier to find exploits in them that cause them to reveal secrets. Go software has stronger memory safety guarantees than C programs like OpenSSH and Nginx. So that's one big benefit of using Caddy. As it happens, someone in the audience here is writing a SSH app for Caddy, so you have a pure Go SSH server that is less vulnerable to those class of attacks.
  - atonse 7y ago
    But what is the value add for Caddy here? Like how the out of box and auto SSL defaults with HTTP. Apart from memory safety, can the SSH version of caddy impose better defaults that OpenSSH doesn’t right now? Maybe TLS certs, security key support, etc?
    - mholt 7y ago
      Absolutely. And Caddy adds its on-line config API and simpler configuration experience for an all-around more secure, easier-to-maintain, harder-to-get-wrong system.
      - atonse 6y ago
        Right, I suppose I'm asking what an elegant SSH config would look like, having almost only ever touched my sshd config less than 10 times in the 15+ years I've managed servers. I know I'd ideally like easier SSO integration, for example. Or provisioning of users.
- deleted 7y ago
  [deleted]
- francislavoie 7y ago
  To add onto what Matt said, here's a teaser: https://twitter.com/mholt6/status/1257073951525572608 https://twitter.com/mholt6/status/1257073951525572608

by mholt 7y ago

chris_st 7y ago

Sorry for the stupid question, but what is a "memory-safe SSH server"? Thanks!

mholt 7y ago
Not a stupid question, it's not a phrase you hear very often because there isn't... really... one... at all. (Not in mainstream use AFAIK?) Memory safety is a class of guarantees certain software offers you against certain vulnerabilities. Software written in C is generally considered "memory unsafe" since it's hard to write correct C code when managing with memory, so it's easier to find exploits in them that cause them to reveal secrets. Go software has stronger memory safety guarantees than C programs like OpenSSH and Nginx. So that's one big benefit of using Caddy. As it happens, someone in the audience here is writing a SSH app for Caddy, so you have a pure Go SSH server that is less vulnerable to those class of attacks.
- atonse 7y ago
  But what is the value add for Caddy here? Like how the out of box and auto SSL defaults with HTTP. Apart from memory safety, can the SSH version of caddy impose better defaults that OpenSSH doesn’t right now? Maybe TLS certs, security key support, etc?
  - mholt 7y ago
    Absolutely. And Caddy adds its on-line config API and simpler configuration experience for an all-around more secure, easier-to-maintain, harder-to-get-wrong system.
    - atonse 6y ago
      Right, I suppose I'm asking what an elegant SSH config would look like, having almost only ever touched my sshd config less than 10 times in the 15+ years I've managed servers. I know I'd ideally like easier SSO integration, for example. Or provisioning of users.
deleted 7y ago
[deleted]
francislavoie 7y ago
To add onto what Matt said, here's a teaser: https://twitter.com/mholt6/status/1257073951525572608 https://twitter.com/mholt6/status/1257073951525572608