29 ms·
People still use Bastion hosts? I'm trying to grok why they're better than SOCKS5 proxies... Is it because they provide shell access and a larger attack surfac
by cbsmith 5y ago
People still use Bastion hosts?
I'm trying to grok why they're better than SOCKS5 proxies... Is it because they provide shell access and a larger attack surface? ;-)
- perlgeek 5y agoAuditing requirements. Many certifications or legal requirements demand that you log all changes to your systems, including administrative changes. Bastion host are a well-understood (both by operators and auditors) way to implement that, so it's still a go-to solution.
- cbsmith 5y agoThat would make a lot of sense if SOCKS5 proxies weren't commonly used for auditing and provide much more transparency about what operations someone is doing on the internal systems.
- noinsight 5y agoSo how do you implement MFA in your SOCKS5 proxy?
- cbsmith 5y agoAuth method flag for SOCKS5 has 0x08 is for MFA.
- ale42 5y agodoes SOCKS5 provide encryption?
- cbsmith 5y agoYes.
- ale42 5y agoBetween the client and the SOCKS5 proxy? Of course using the SSH SOCKS proxy will encrypt data, I was rather thinking to a plain SOCKS5 proxy. Are there clients and servers supporting SOCKS-level encryption between the client and the proxy? I didn't see that possibility the last time I've read the SOCKS standard (but it was a few years ago).