3 ms·

Another option is not actually expose SSH at all and proxy shells through a web server via WebSockets, fronted by xterm.js or hterm.js. There are some limitatio

Another option is not actually expose SSH at all and proxy shells through a web server via WebSockets, fronted by xterm.js or hterm.js. There are some limitations here (like ctrl-W will get captured by the browser rather than the shell) but it is relatively easy to implement and fits a lot of use cases without the nightmare of fitting Linux PAM to your organization's evolving IAM needs. Won't work for everyone, but definitely something to consider if you are offering "shell-as-a-service" internally or externally.

R0b0t1 5y ago
Superficially this sounds good but if you don't trust the security of SSH you need to ask why you trust TLS any more.
- pphysch 5y ago
  It's not about trusting the security of SSH vs TLS, but rather the ergonomics of deploying either technology. All the Big Cloud providers offer both, last time I checked. Point is, you can offer a secure & functional remote shell without touching Linux PAM or the Linux authx stack beyond `useradd` and a locked-down `sshd_config`. Orgs that already offer web services over HTTPS may find this route desirable.
  - DarylZero 5y ago
    > without touching Linux PAM or the Linux authx stack ..falsely implying you'd have to "touch" this stuff to set up OpenSSH on port 22.
    - pphysch 5y ago
      If you are exposing SSH to the world or your customers, you have to do a lot more than "touch" this stuff to achieve reasonable security. That's the point.
      - DarylZero 5y ago
        No you don't. Why would you need to modify PAM for SSH on port 22 but not SSH over TLS?
        pphysch 5y ago
        Because you completely handle authn/authz on the web backend instead of in PAM No one gets a shell until they get through your RBAC/ABAC solution
        DarylZero 5y ago
        The question was: > Why would you need to modify PAM for SSH on port 22? I don't believe you have an answer.
        deleted 5y ago
        [deleted]
        pphysch 5y ago
        Because in 2022 we have access to things like 2FA and ABAC and SSH certs to not get pwned. How do you intend on implementing those without Linux PAM or additional backend services??
      - gz5 5y ago
hackernudes 5y ago
I have done ssh-over-websocket before (so that is TLS + SSH). I did it do get around a restrictive work proxy. Don't tell IT. I even patched socat to support websocket so it was easy to use with ssh's ProxyCommand. I plan to use this scheme instead of having a bastion server to access containers.

R0b0t1 5y ago

Superficially this sounds good but if you don't trust the security of SSH you need to ask why you trust TLS any more.

pphysch 5y ago
It's not about trusting the security of SSH vs TLS, but rather the ergonomics of deploying either technology. All the Big Cloud providers offer both, last time I checked. Point is, you can offer a secure & functional remote shell without touching Linux PAM or the Linux authx stack beyond `useradd` and a locked-down `sshd_config`. Orgs that already offer web services over HTTPS may find this route desirable.
- DarylZero 5y ago
  > without touching Linux PAM or the Linux authx stack ..falsely implying you'd have to "touch" this stuff to set up OpenSSH on port 22.
  - pphysch 5y ago
    If you are exposing SSH to the world or your customers, you have to do a lot more than "touch" this stuff to achieve reasonable security. That's the point.
    - DarylZero 5y ago
      No you don't. Why would you need to modify PAM for SSH on port 22 but not SSH over TLS?
      - pphysch 5y ago
        Because you completely handle authn/authz on the web backend instead of in PAM No one gets a shell until they get through your RBAC/ABAC solution
        DarylZero 5y ago
        The question was: > Why would you need to modify PAM for SSH on port 22? I don't believe you have an answer.
        deleted 5y ago
        [deleted]
        pphysch 5y ago
        Because in 2022 we have access to things like 2FA and ABAC and SSH certs to not get pwned. How do you intend on implementing those without Linux PAM or additional backend services??
    - gz5 5y ago

hackernudes 5y ago

I have done ssh-over-websocket before (so that is TLS + SSH). I did it do get around a restrictive work proxy. Don't tell IT. I even patched socat to support websocket so it was easy to use with ssh's ProxyCommand. I plan to use this scheme instead of having a bastion server to access containers.