5 ms·

Superficially this sounds good but if you don't trust the security of SSH you need to ask why you trust TLS any more.

• pphysch 5y ago
  It's not about trusting the security of SSH vs TLS, but rather the ergonomics of deploying either technology. All the Big Cloud providers offer both, last time I checked. Point is, you can offer a secure & functional remote shell without touching Linux PAM or the Linux authx stack beyond `useradd` and a locked-down `sshd_config`. Orgs that already offer web services over HTTPS may find this route desirable.
  • DarylZero 5y ago
    > without touching Linux PAM or the Linux authx stack ..falsely implying you'd have to "touch" this stuff to set up OpenSSH on port 22.
    • pphysch 5y ago
      If you are exposing SSH to the world or your customers, you have to do a lot more than "touch" this stuff to achieve reasonable security. That's the point.
      • DarylZero 5y ago
        No you don't. Why would you need to modify PAM for SSH on port 22 but not SSH over TLS?
        • pphysch 5y ago
          Because you completely handle authn/authz on the web backend instead of in PAM No one gets a shell until they get through your RBAC/ABAC solution
          • DarylZero 5y ago
            The question was: > Why would you need to modify PAM for SSH on port 22? I don't believe you have an answer.
            • deleted 5y ago
              [deleted]
            • pphysch 5y ago
              Because in 2022 we have access to things like 2FA and ABAC and SSH certs to not get pwned. How do you intend on implementing those without Linux PAM or additional backend services??
      • gz5 5y ago