3 ms·

Yearly reminder to run your ssh server behind spiped.[1] [2] [3] [1] https://www.tarsnap.com/spiped.html https://www.tarsnap.com/spiped.html [2] https://news.

Yearly reminder to run your ssh server behind spiped.[1] [2] [3] [1] https://www.tarsnap.com/spiped.html https://www.tarsnap.com/spiped.html [2] https://news.ycombinator.com/item?id=29483092 https://news.ycombinator.com/item?id=29483092 [3] https://news.ycombinator.com/item?id=28538750 https://news.ycombinator.com/item?id=28538750

gruez 2y ago
What's the advantage of this relatively obscure tool compared to something standard like wireguard or stunnel?
- acatton 2y ago
  * The tool is not obscure, it's packaged in most distributions.[1][2][3] It was written and maintained by Colin Percival, aka "the tarnsnap guy" or "the guy who invented scrypt". He is the security officer for FreeBSD. * spiped can be used transparently by just putting a "ProxyCommand" in your ssh_config. This means you can connect to a server just by using "ssh", normally. (as opposed to wireguard where you need to always be on your VPN, otherwise connnect to your VPN manually before running ssh) * As opposed to wireguard which runs in the kernel, spiped can easily be set-up to run as a user, and be fully hardened by using the correct systemd .service configuration [4] * The protocol is much more lightweight than TLS (used by stunnel), it's just AES, padded to 1024 bytes with a 32 bit checksum. [5] * The private key is much easier to set up than stunnel's TLS certificate, "dd if=/dev/urandom count=4 bs=1k of=key" and you're good to go. [1] https://packages.debian.org/bookworm/spiped https://packages.debian.org/bookworm/spiped [2] https://www.freshports.org/sysutils/spiped/ https://www.freshports.org/sysutils/spiped/ [3] https://archlinux.org/packages/extra/x86_64/spiped/ https://archlinux.org/packages/extra/x86_64/spiped/ [4] https://ruderich.org/simon/notes/systemd-service-hardening https://ruderich.org/simon/notes/systemd-service-hardening [5] https://github.com/Tarsnap/spiped/blob/master/DESIGN.md https://github.com/Tarsnap/spiped/blob/master/DESIGN.md
  - SparkyMcUnicorn 2y ago
    Wireguard can also run in userspace (e.g. boringtun[0], wireguard-go[1], Tailscale). [0] https://github.com/cloudflare/boringtun https://github.com/cloudflare/boringtun [1] https://git.zx2c4.com/wireguard-go/about/ https://git.zx2c4.com/wireguard-go/about/
  - sisk 2y ago
    > The private key is much easier to set up than stunnel's TLS certificate, "dd if=/dev/urandom count=4 bs=1k of=key" and you're good to go. The spiped documentation recommends a key size with a minimum of 256b of entropy. I'm curious why you've chosen such a large key size (4096b) here? Is there anything to suggest 256b is no longer sufficient for the general case?
    - acatton 2y ago
      Force of habit. No particular reason, "4kiB feels like a nice number", cargo culting. Choose one :) . It doesn't matter if you have more than 256 bits, as your key file gets hashed with SHA256 at the end[1]. It could be 5GiB it would be the same. So yes, you're right to mention that more bits don't add more security. [1] https://github.com/Tarsnap/spiped/blob/2194b2c64de65eed119ab01f06c8adb2233caab8/lib/proto/proto_crypt.c#L114 https://github.com/Tarsnap/spiped/blob/2194b2c64de65eed119ab...
  - cperciva 2y ago
    Correction: I was the security officer for FreeBSD... about a dozen years ago. I'm now the release engineering lead.
betaby 2y ago
I run sshd behind the HAProxy https://www.haproxy.com/blog/route-ssh-connections-with-haproxy https://www.haproxy.com/blog/route-ssh-connections-with-hapr...

gruez 2y ago

What's the advantage of this relatively obscure tool compared to something standard like wireguard or stunnel?

acatton 2y ago
* The tool is not obscure, it's packaged in most distributions.[1][2][3] It was written and maintained by Colin Percival, aka "the tarnsnap guy" or "the guy who invented scrypt". He is the security officer for FreeBSD. * spiped can be used transparently by just putting a "ProxyCommand" in your ssh_config. This means you can connect to a server just by using "ssh", normally. (as opposed to wireguard where you need to always be on your VPN, otherwise connnect to your VPN manually before running ssh) * As opposed to wireguard which runs in the kernel, spiped can easily be set-up to run as a user, and be fully hardened by using the correct systemd .service configuration [4] * The protocol is much more lightweight than TLS (used by stunnel), it's just AES, padded to 1024 bytes with a 32 bit checksum. [5] * The private key is much easier to set up than stunnel's TLS certificate, "dd if=/dev/urandom count=4 bs=1k of=key" and you're good to go. [1] https://packages.debian.org/bookworm/spiped https://packages.debian.org/bookworm/spiped [2] https://www.freshports.org/sysutils/spiped/ https://www.freshports.org/sysutils/spiped/ [3] https://archlinux.org/packages/extra/x86_64/spiped/ https://archlinux.org/packages/extra/x86_64/spiped/ [4] https://ruderich.org/simon/notes/systemd-service-hardening https://ruderich.org/simon/notes/systemd-service-hardening [5] https://github.com/Tarsnap/spiped/blob/master/DESIGN.md https://github.com/Tarsnap/spiped/blob/master/DESIGN.md
- SparkyMcUnicorn 2y ago
  Wireguard can also run in userspace (e.g. boringtun[0], wireguard-go[1], Tailscale). [0] https://github.com/cloudflare/boringtun https://github.com/cloudflare/boringtun [1] https://git.zx2c4.com/wireguard-go/about/ https://git.zx2c4.com/wireguard-go/about/
- sisk 2y ago
  > The private key is much easier to set up than stunnel's TLS certificate, "dd if=/dev/urandom count=4 bs=1k of=key" and you're good to go. The spiped documentation recommends a key size with a minimum of 256b of entropy. I'm curious why you've chosen such a large key size (4096b) here? Is there anything to suggest 256b is no longer sufficient for the general case?
  - acatton 2y ago
    Force of habit. No particular reason, "4kiB feels like a nice number", cargo culting. Choose one :) . It doesn't matter if you have more than 256 bits, as your key file gets hashed with SHA256 at the end[1]. It could be 5GiB it would be the same. So yes, you're right to mention that more bits don't add more security. [1] https://github.com/Tarsnap/spiped/blob/2194b2c64de65eed119ab01f06c8adb2233caab8/lib/proto/proto_crypt.c#L114 https://github.com/Tarsnap/spiped/blob/2194b2c64de65eed119ab...
- cperciva 2y ago
  Correction: I was the security officer for FreeBSD... about a dozen years ago. I'm now the release engineering lead.

betaby 2y ago

I run sshd behind the HAProxy https://www.haproxy.com/blog/route-ssh-connections-with-haproxy https://www.haproxy.com/blog/route-ssh-connections-with-hapr...