3 ms·

How’s this work with things that aren’t websites? Do you have to throw a proxy in front of e.g., your database server that keeps track of which IPs have alread

by xienze 6y ago

How’s this work with things that aren’t websites? Do you have to throw a proxy in front of e.g., your database server that keeps track of which IPs have already authenticated over the web?

brandon 6y ago
Historically at Google the exceptions fell into one of a few buckets: * You used a modified client or client proxy (this was done for e.g. SSH) * You used a remote-desktop protocol to remote into a machine with direct network access to the service * The service got a wholesale exemption and was allowed through the firewall with ordinary IP ACLs (descending order of impressiveness wrt the BeyondCorp philosophy and whitepaper) Some of this is discussed in the "Non-HTTP Protocols" section of this paper: https://www.usenix.org/system/files/login/articles/login_winter16_05_cittadini.pdf https://www.usenix.org/system/files/login/articles/login_win...
- Spivak 6y ago
  Why would you ever need option 2/3 when the IAP exists? Is there stuff that doesn’t work over a tunneled connection?
  - __float 6y ago
    the iap is an http proxy, so you need a way to send non-http traffic. this might require client modifications (not everything is proxy-aware), and you can't always modify the source. some protocols are udp and latency sensitive, which doesn't work well enough tunneled
closeparen 6y ago
You run a service behind the HTTP proxy, or another proxy with a more suitable protocol like SSH, which can speak the required protocols (or just blindly forward TCP) across production. You run a CLI tool that binds a local port and forwards to this service. In some ways this is a poor man's VPN server, but it can be smarter: with protocol support, you can combine the identity of the connected developer with application-level data (e.g. this is an INSERT statement) to make AuthZ decisions.
ndomer 6y ago
(Author here) At Transcend, we use a bastion host (like others have mentioned). The key difference that we do that I don't think has been covered is that our bastion only makes outgoing connections, and has no open ports to the world. Using the AWS SSM managed service, we can create bastions that have no ingress at all. I talk through some different approaches in a codelab over here: https://codelabs.transcend.io/codelabs/aws-ssh-ssm-rds/index.html?index=..%2F..index#0 https://codelabs.transcend.io/codelabs/aws-ssh-ssm-rds/index...

by xienze 6y ago

How’s this work with things that aren’t websites? Do you have to throw a proxy in front of e.g., your database server that keeps track of which IPs have already authenticated over the web?

brandon 6y ago

Historically at Google the exceptions fell into one of a few buckets: * You used a modified client or client proxy (this was done for e.g. SSH) * You used a remote-desktop protocol to remote into a machine with direct network access to the service * The service got a wholesale exemption and was allowed through the firewall with ordinary IP ACLs (descending order of impressiveness wrt the BeyondCorp philosophy and whitepaper) Some of this is discussed in the "Non-HTTP Protocols" section of this paper: https://www.usenix.org/system/files/login/articles/login_winter16_05_cittadini.pdf https://www.usenix.org/system/files/login/articles/login_win...

Spivak 6y ago
Why would you ever need option 2/3 when the IAP exists? Is there stuff that doesn’t work over a tunneled connection?
- __float 6y ago
  the iap is an http proxy, so you need a way to send non-http traffic. this might require client modifications (not everything is proxy-aware), and you can't always modify the source. some protocols are udp and latency sensitive, which doesn't work well enough tunneled

closeparen 6y ago

You run a service behind the HTTP proxy, or another proxy with a more suitable protocol like SSH, which can speak the required protocols (or just blindly forward TCP) across production. You run a CLI tool that binds a local port and forwards to this service. In some ways this is a poor man's VPN server, but it can be smarter: with protocol support, you can combine the identity of the connected developer with application-level data (e.g. this is an INSERT statement) to make AuthZ decisions.

ndomer 6y ago

(Author here) At Transcend, we use a bastion host (like others have mentioned). The key difference that we do that I don't think has been covered is that our bastion only makes outgoing connections, and has no open ports to the world. Using the AWS SSM managed service, we can create bastions that have no ingress at all. I talk through some different approaches in a codelab over here: https://codelabs.transcend.io/codelabs/aws-ssh-ssm-rds/index.html?index=..%2F..index#0 https://codelabs.transcend.io/codelabs/aws-ssh-ssm-rds/index...