9 ms·
SSH has no Host header
- Eikon 7mo agoI am not sure to understand what this is this achieving compared to just assigning a ip + port per vm?
- otterley 7mo agoNot needing a different port. Middleboxes sometimes block ssh on nonstandard ports. Also, to preserve the alignment between the SSH hostname and the web service hostname, as though the user was accessing a single host at a single public address. Usability is key for them.
- Charon77 7mo agoThey don't want each vm to have different public IP
- deleted 7mo ago[deleted]
- gsich 7mo agoMiddleboxes are not relevant in this scenario.
- otterley 7mo agoUh, why not? Unless your SSH client is on the same network as theirs, there are going to be middleboxes somewhere in the path.
- gsich 7mo agoBecause your ISP should (and most do not) alter traffic.
- otterley 7mo agoBut you’re not considering the many business environments that do.
- gsich 7mo agoI don't because that would be impossible. Every business has different rules. But if you (as a business) want to to use this, you will find a way to make the changes to those "middleboxes". It's not your network, it's your business's network.
- otterley 7mo agoLarge multi-national corporations, by way of their sheer size, tend to force their vendors to bend towards their needs, not to adapt to meet their vendors' unusual networking requirements.
- gsich 7mo agoThankfully SSH on non-22 is not unusual.
- otterley 7mo agoOf all the SSH servers in the world, what percentage are listening on a port other than 22? To answer this question, you can visit https://data-status.shodan.io/ports.html https://data-status.shodan.io/ports.html and see for yourself. By "unusual," I literally mean "not usual/not typical." Not "never happens."
- Dylan16807 7mo agoWhy would anyone configure it to do that? Like, I understand the really restrictive ones that only allow web browsing. But why allow outgoing ssh to port 22 but not other ports? Especially when port 22 is arguably the least secure option. At that point let people connect to any port except for a small blacklist.
- otterley 7mo agoI’m not a network security expert, so I don’t know the threat model. I just know that this is a thing companies do sometimes.
- josephcsible 7mo agoMiddlebox operators aren't known for making reasonable or logical decisions.
- 9dev 7mo agoAsking back, when I limit the outgoing connections from a network, why would I account for any nonstandard port and make the ruleset unwieldy, just in case someone wanted to do something clever?
- Dylan16807 7mo agoA simple ruleset would only block a couple dangerous ports and leave everything else connectable. Whitelisting outgoing destination ports is more complicated and more annoying to deal with for no benefit. The only place you should be whitelisting destination ports is when you're looking at incoming connections.
- 9dev 7mo agoI definitely block outgoing ports on all our servers by default; Established connections, HTTP(S), DNS, NTP, plus infra-specific rules. There is really no legitimate reason to connect to anything else. The benefit is defence against exfiltration.
- CGamesPlay 7mo agoUsing nonstandard ports would break the `ssh foo.exe.dev` pattern. This could also have been solved by requiring users to customize their SSH config (coder does this once per machine, and it applies to all workspaces), but I guess the exe.dev guys are going for a "zero-config, works anywhere" experience.
- w-ll 7mo ago-p ?
- deleted 7mo ago[deleted]
- hrmtst93837 7mo ago[flagged]
- CGamesPlay 7mo agoSSH configs support wildcards, so if you couple it with a ProxyCommand you can an arbitrary level of dynamism for a host pattern (like *.exe.dev). But yeah, everything is a trade-off.
- KomoD 7mo agoToo bad most SSH clients don't seem to support SRV records, they would've been perfect for this: ;; Domain: mydomain.com. ;; SSH running on port 2999 at host 1.2.3.4 ;; A Record vm1928.mydomain.com. 1 IN A 1.2.3.4 ;; SRV Record _ssh._tcp.vm1928.mydomain.com. 1 IN SRV 0 0 2999 vm1928.mydomain.com. If supported it would result in just being able to do "ssh vm1928.mydomain.com" without having to add "-p 1928"
- dlenski 7mo agoSSH is an incredibly versatile and useful tool, but many things about the protocol are poorly designed, including its essentially made-up-as-you-go-along wire formats for authentication negotiation, key exchange, etc. In 2024-2025, I did a survey of millions of public keys on the Internet, gathered from SSH servers and users in addition to TLS hosts, and discovered—among other problems—that it's incredibly easy to misuse SSH keys in large part because they're stored "bare" rather than encapsulated into a certificate format that can provide some guidance as to how they should be used and for what purposes they should be trusted: https://cryptographycaffe.sandboxaq.com/posts/survey-public-keys-internet/#keys-that-were-not-generated-using-best-practices:~:text=SSH%20typically%20uses%20%E2%80%9Cbare%E2%80%9D%20keys%20and%20lacks%20a%20mechanism%20like%20the%20X.509%20key%20usage%20extension%20which%20can%20be%20used%20to%20define%20the%20intended%20purpose%20of%20a%20key%2C%20and%20thus%20limit%20its%20inadvertent%20misuse%20for%20an%20unrelated%20purpose https://cryptographycaffe.sandboxaq.com/posts/survey-public-....
- Charon77 7mo agoWhat good does certificate format do? Certainly won't make people not reuse it the same way. > where the affected users might be surprised or alarmed to learn that it is possible to link these real-world identities. I feel like it's obvious that ssh public keys publically identifies me, and if I don't want that, I can make different keys for different sites.
- bauruine 7mo agossh by default sends all your public keys to a server. Yes you can limit some keys to specific hosts but it's very easy to dox yourself.
- ulrikrasmussen 7mo agoI had never thought about that. Seems like an easy problem to fix by sending salted hashes instead.
- 7mo ago
- 3r7j6qzi9jvnve 7mo agoI wonder if it's something like https://github.com/cea-hpc/sshproxy https://github.com/cea-hpc/sshproxy that sits in the middle (with decryption and everything) or if they could do this without setting up a session directly with the client. Well, we're implicitly trusting the host when running a VM anyway (most of the time), but it's something I'd want to check before buying into the service. EDIT: Ah, it's probably https://github.com/boldsoftware/sshpiper https://github.com/boldsoftware/sshpiper will try to remember to look later.
- kro 7mo agoAlmost certainly it does, as public key auth takes place after setting up the session encryption
- otterley 7mo agoThis is a clever trick, but I can’t help but wonder where it breaks. There seems to be an invariant that the number of backends a public key is mapped to cannot exceed the number of proxy IPs available. The scheme probably works fine if most people are only using a small number of instances, though. I assume this is in fact the case. Another thing that just crossed my mind is that the proxy IP cannot be reassigned without the client popping up a warning. That may alarm security-conscious users and impact usability.
- cortesoft 7mo agoThey just need to set the limit on the number of VMs per user to be less than or equal to the number of public IPs they have available. As long as two users don't try to share a key, you are good... which should be easy, just don't let them upload a key that another user has already uploaded.
- ulrikrasmussen 7mo agoI also wonder what happens if you want to grant access to your VM to additional public keys and one of those public keys happen to already be routed to a different VM on the same IP.
- krautsauer 7mo agoSSH waits for the server key before it presents the client keys, right? Does this mean that different VMs from different users have the same key? (Or rather, all VMs have the same key? A quick look shows s00{1,2,3}.exe.xyz all having the same key.) So this is full MitM?
- cortesoft 7mo agoI mean, anytime you use the cloud for anything, you are giving MITM capabilities to the hosting provider. It is their hardware, their hypervisors... they can access anything inside the VMs
- yaur 7mo agoThis approach doesn't give access from the hypervisor to your private keys it gives access to other tenants to your private keys.
- TZubiri 7mo agoI think the vulnerability would be that not only the host can now MITM, but other co-tenants would have the capability to bypass that MiTM protection.
- rwmj 7mo agoNot if it's using Confidential Computing. Then you're trusting "only" the CPU vendor (plus probably the government of the country where that vendor is located), but you're trusting the CPU already.
- unsnap_biceps 7mo agoYou are correct, but I expect they instruct their users to run with a host key validation disabled ( StrictHostKeyChecking=no UserKnownHostsFile=/dev/null) , as they expect these are ephemeral instances.
- morpheuskafka 7mo agoThey are saying they want to directly SSH into a VM/container based on the web hostname it serves. But that's not how the HTTP traffic flows either. With only one routable IP for the host, all traffic on a port shared by VMs has to go to a server on the host first (unless you route based on port or source IP with iptnbles, but that is not hostname based). The HTTP traffic goes to a server (a reverse proxy, say nginx) on the host, which then reads it and proxies it to the correct VM. The client can't ever send TCP packets directly to the VM, HTTP or otherwise. That doesn't just magically happen because HTTP has a Host header, only because nginx is on the host. What they want is a reverse proxy for SSH, and doesn't SSH already have that via jump/bastion hosts? I feel like this could be implement with a shell alias, so that: ssh user@vm1.box1.tld becomes: ssh -j jumpusr@box1.tld user@vm1 And just make jumpusr have no host permissions and shell set to only allow ssh.
- Dylan16807 7mo agoIf jump host shell aliases were a valid option, then setting a port would be a much easier valid option.
- lmm 7mo agoThe point is that they want the simple UX of "ssh vm1.box1.tld" takes you to the same machine that browsing to vm1.box1.tld takes you to, without requiring their users to set any additional configuration.
- bfivyvysj 7mo agoYou can have that already? It's just dns. Are you saying different vms share the same box1 ip? Well then yeah, you want a reverse proxy on some shared ip.
- dwedge 7mo ago> Well then yeah, you want a reverse proxy on some shared ip. At that point you run into the problem that SSH doesn't have a host header and write this blog post.
- spanjer 7mo ago[dead]
- miyuru 7mo ago> We cannot issue an IPv4 address to each machine without blowing out the cost of the subscription. We cannot use IPv6-only as that means some of the internet cannot reach the VM over the web. That means we have to share IPv4 addresses between VMs. Give a user a option for use IPv6 only, and if the user need legacy IP add it as a additional cost and move on. Trying to keep v4 at the same cost level as v6 is not a thing we can solve. If it was we wouldn't need v6.
- YesThatTom2 7mo agoThis is the way.
- TZubiri 7mo agoOp solved a problem and your comment is "I wouldn't have solved the problem". >legacy IP lol
- 9dev 7mo agoIt's a nice solution for sure, but a problem by choice. You could just have an AAAA record for the domain in addition to the A record, and as GP pointed out, resolve SSH sessions via the IPv6. If the user wants SSH to work with IPv4 for whatever reason—I see the point that there may be some web visitors without IPv6 still, but devs?—they could pay a small extra for a dedicated IPv4 address.
- lifthrasiir 7mo agoThey could buy a dedicated IPv4 address, but that address still has to be tunneled through [EDIT:] IPv6 networks if that dev has no access to [EDIT:] IPv4 networks. Thus DX still suffers. [ADDENDUM: I mistakenly swapped "IPv4" and "IPv6" there. See comments.]
- 9dev 7mo agoI'm not sure I understand your point; if exe.dev operates a dedicated IP solely so a specific mythical IPv6-less developer can connect to a specific server, then there's no tunnelling involved at all.
- c45y 7mo agoI would love it if more systems just understood SRV records, hostname.xyz = 10.1.1.1:2222 So far it feels like only LDAP really makes use of it, at least with the tech I interact with
- iwontberude 7mo agoI love that kubernetes does this for cluster service domain names
- jiehong 7mo agoIt’s also similar with mDNS on local networks. It’s actually nice! Overall, DNS features are not always well implemented on most software stack. A basic example is the fact that DNS resolution actually returns a list of IPs, and the client should be trying them sequentially or in parallel, so that one can be down without impact and annoying TTL propagation issues. Yet, many languages have a std lib giving you back a single IP, or a http client assuming only one, the first.
- geocar 7mo agoThis has history: https://egopoly.com/2008/02/ssh-slow-on-leopard.html https://egopoly.com/2008/02/ssh-slow-on-leopard.html I also know of https://github.com/Crosse/sshsrv https://github.com/Crosse/sshsrv and other tricks I agree more SRV records would have helped with a tremendous number of unnecessary proxies and wasted heat energy from unnecessary computing, but in this day and age, I think ECH/ESNI-type functions should be considered for _every_ new protocol.
- ComputerGuru 7mo agoSRV is essentially a simple layer of abstraction that provides (via one approach) the required end result (reachability + UX) that is easy to add to any $PROTO client without. Supporting ESNI would complicate the actual lib/protocol, increase the amount of dev and maintenance work required all around, significantly increase complexity, and require more infrastructure and invasive integration than any DNS-enabled service already uses.
- 7mo ago
- shablulman 7mo ago[dead]
- XorNot 7mo agoThe solution to this is TLS SNI redirecting. You can front a TLS server on port 443 and then redirect without decrypting the connection based on the SNI name to your final destination host.
- J-Kuhn 7mo agoBut... this doesn't work for SSH, which is the problem here?
- XorNot 7mo agoSSH has ProxyCommand which accepts the %h template. Provided your users will configure something a little - or you provide a wrapping command - you can setup the tunneling for them.
- devnotes77 7mo ago[dead]
- miladyincontrol 7mo agoIm not saying its the solution I would implement but caddy's L4 module does let you do this, essentially using TLS as a tunnel and openssl in the proxy command to terminate it client side.
- binarin 7mo agoIn kinda the same situation, I was using username for host routing. And real user was determined by the principal in SSH certificate - so the proxy didn't even need to know the concrete certificates for users; it was even easier than keeping track of user SSH keys. Certificate signing was done by a separate SSH service, which you connected too with enabled SSH agent forwarding, pass 2FA challenge, and get a signed cert injected into your agent.
- unsnap_biceps 7mo agoCan you expand on your solution a little bit? AFAIK principals don't impact the user that is logged in at all. A principal in the cert and in the authorized list just allows the user to log in as any user they want, which is why you have to write a script that validates the username before listing principals to accept. I'd love to learn more about how you solved it and what I may be mistaken about.
- binarin 7mo agoWhat I had is roughly the following: users connects via SFTP to external.website.com@my.proxy.com. Proxy server (which handles SSH protocol itself) authenticates the user using the principal, then checks whether this principal is allowed to access an external web-site and what exactly it can do here. Then proxy connects to the external website using its own secret credentials. In the end, it solved the problem of having a shared google doc with a bunch of passwords in there which everyone had access to.
- charcircuit 7mo agoYou don't need SSH. Installing an SSH server to such a VM is a hold over from how UNIX servers worked. It puts you in the mindset of treating your server as a pet and doing things for a single vm instead of having proper server management in place. I would reconsider if offering ssh is an actual requirement here or if it could be better served by offering users a proper control panel to manage and monitor the vms.
- mystifyingpoi 7mo agoCould you suggest an alternative then? Something that is feature complete with SSH server, and also free.
- charcircuit 7mo agoI have not worked in the server management in many years, but with how cheap code is with AI rolling your own dashboard may not be such a bad idea. >with SSH server My comment was about how you do not need an ssh server. The idea of a server exposing a command line that allows potentially anything to be done is not necessary in order to manage and monitor a server.
- sirl1on 7mo agoTreating your server as pet may perfectly fine. Not everything has to be fully automated cloud cluster cattle.
- charcircuit 7mo agoEven as a pet I think a proper interface for managing the server would be better and more secure than ssh.
- dspillett 7mo agoOften those proper interfaces are wrappers around what you would run via SSH and add their own security holes, so I would argue against “more secure than SSH”.
- thaumaturgy 7mo agoYeah, I ran into this problem too. I tried a few different hacky solutions and then settled on using port knocking to sort inbound ssh connections into their intended destinations. Works great. I have an architecture with a single IP hosting multiple LXC containers. I wanted users to be able to ssh into their containers as you would for any other environment. There's an option in sshd that allows you to run a script during a connection request so you can almost juggle connections according to the username -- if I remember right, it's been several years since I tried that -- but it's terribly fragile and tends to not pass TTYs properly and basically everything hates it. But, set up knockd, and then generate a random knock sequence for each individual user and automatically update your knockd config with that, and each knock sequence then (temporarily) adds a nat rule that connects the user to their destination container. When adding ssh users, I also provide them with a client config file that includes the ProxyCommand incantation that makes it work on their end. Been using this for a few years and no problems so far.
- dwedge 7mo agoDoesn't this require configuration at the end user, so you could just as easily ProxyJump or use a different port? It's a nice solution but I've been looking for something more transparent (getting them to configure an SSH key is already difficult for them). A reverse proxy that selects backend based solely on the SSH key fingerprint would be ideal
- thaumaturgy 7mo agoThat's all true, but juggling connections based on key fingerprints would also require users to have different keys for different containers -- which is good practice, but I've found that it's equally difficult for users unfamiliar with ssh to set up and properly manage more than one key, and it's equally easy for users familiar with ssh to manage multiple client configs. That and ProxyJump both also require the container-host to negotiate ssh connections, which is... fine, I guess? But the port knocking approach means that the only thing the container-host is doing is port forwarding, which gives it like half an extra point in my calculus.
- snvzz 7mo agoThe solution is ipv6.
- TZubiri 7mo agoIt's hard to think of a clearer example for the concept of Developer Experience. One similar example of SSH related UX design is Github. We mostly take the git clone git@github.com/author/repo for granted, as if it were a standard git thing that existed before. But if you ever go broke and have to implement GitHub from scratch, you'll notice the beauty in its design.
- ulrikrasmussen 7mo agoWouldn't a much simpler approach be to have everyone log in to a common server which sits on a VPN with all the VMs? It introduces an extra hop, but this is a pretty minor inconvenience and can be scripted away.
- duckerduck 7mo agoThey kind of already have a central point with 'ssh exe.dev', which hosts the interface for provisioning new VMs. But yeah, still one extra step for the user.
- YooLc 7mo agoWhy not include header in the username field :) Take a look at this repo: https://github.com/mrhaoxx/OpenNG https://github.com/mrhaoxx/OpenNG It allows you to connect multiple hosts using the same IP, for example: ssh alice+hostA@example.com -> hostA ssh alice+hostB@example.com -> hostB
- jeroenhd 7mo agoI think that would work just fine for most use cases, though you may run into people trying to set up weird usernames on their VMs that conflict with the host split config. Still, this is the best zero-config solution in my opinion, much simpler than the solution they decided to go with.
- est 7mo agojump servers, it's a thing and a good security measure.
- szszrk 7mo agoAnd it's easy to create a clean 3 lines of ssh client config for the user to later just do `ssh name` Even less things to remember + you have documented your hostnames in the process.
- hamandcheese 7mo agoThis would be a great use case of SSH over HTTP/3[0]. Sadly it doesn't seem to have gained traction. [0]: https://www.ietf.org/archive/id/draft-michel-ssh3-00.html https://www.ietf.org/archive/id/draft-michel-ssh3-00.html
- geocar 7mo agoInitial thoughts are it's a meh protocol that does not look well thought-out, has fewer features than SSH, to the point I'm not sure it deserves to be called SSH3 and not telnet-over-websockets. Also, there's already an SSH3 https://marc.info/?l=openssh-unix-dev&m=99840513407690&w=2 https://marc.info/?l=openssh-unix-dev&m=99840513407690&w=2 so I _really_ think the thing you're thinking of is just some namesquatter assuming it has any connection to openssh or ssh. I also know how to use SRV records so this is a non-issue for me and everyone I work with.
- thomashabets2 7mo agoWhile not transparent to users, I'd just use SSH ProxyCommand like I did in https://github.com/ThomasHabets/huproxy https://github.com/ThomasHabets/huproxy Not exactly what i built in for, but it'll do the job here too, and able to connect to private addresses on the server side.
- fcpk 7mo agoI mean it works... but it's really ghetto. You have to handle username collisions(or enforce unique usernames). IPv4 should be non free, and that'd cover the costs...
- ksk23 7mo agoOnce hooked into PAM to have a central „ssh box“ mount remote boxes filesystems on user connect. Just need to have a lookup table: which username belongs to wich customer(s server). Ezpz.
- gorgoiler 7mo agoHosting DNS on the same machine as your application opens up all sorts of nice hacks. For example, you can add domain names to nf_conntrack by noticing the client resolving example.com to 10.0.0.1, then making a connection to 10.0.0.1 tcp/443. This was how I made my own “little snitch” like tool.
- dwedge 7mo agoThis is a problem I've come up against a few times. Enforcing a different key per server would also help solve it in their case, but really I just want a haproxy plugin that allows selecting a backend based on the public key
- amtamt 7mo agoSince 2020, based on hostname, routing is possible to different ssh backends https://www.haproxy.com/blog/route-ssh-connections-with-haproxy https://www.haproxy.com/blog/route-ssh-connections-with-hapr... from the blog > Did you know that you can proxy SSH connections through HAProxy and route based on hostname?
- loktarogar 7mo agoI'm building something that has to share a pool of phone numbers for SMS between many businesses with many clients and the architecture I had planned out looks a lot like this - client gets assigned a phone number from the pool for all its interactions with a certain business. Good write up of a tricky problem, and glad to real-world validate the solution I was considering.
- elric 7mo agoTwo options I use: 1. Client side: ProxyJump, by far the easiest 2. Server side: use ForceCommand, either from within sshd_config or .ssh/authorized_keys, based on username or group, and forward the connection that way. I wrote a blogpost about this back in 2012 and I assume this still mostly works, but it probably has some escaping issues that need to be addressed: https://blog.melnib.one/2012/06/12/ssh-gateway-shenanigans/ https://blog.melnib.one/2012/06/12/ssh-gateway-shenanigans/
- niobe 7mo agoI had to reread the first paragraph several times before I understood - the author was misuing a term. > unexpected-behaviour.exe.dev That is not a URL, that's a fully qualified domain name (FQDN), often referred to as just 'hostname'.
- spwa4 7mo agoTrue, BUT you can use proxycommand in sshconfig, along with wildcard matches to make this sort of thing very practical, at the cost of a single config change.
- dspillett 7mo agoThe workaround I use for my own stuff is to have a single jump-host that listens on the public IPv4 address and from there connect to the others. I can still just ssh username@namedhost (which could be username@www.websitehostedonthevm.tld, though I usually give short aliases in .ssh/config) without extra command-line options with the on-time config of adding a host entry in .ssh/config listing the required jump host and internal IP address. Connecting this way (rather than alternatives like manual multi-hop) means all my private keys stay local rather than needing to be on the jump host, without needing to muck around with a key agent. I even do this despite having a small range of routable IPv4s pointing at home, so I don't really need to most of the time. And as an obscurity measure the jump/bastion host can only be contacted by certain external hosts too, though this does still leave my laptop as a potential single point of security failure (and of course adds latency) and one or any bot trying to get in needs to jump through a few hoops to do so.
- jamesvzb 7mo ago[flagged]
- oleh_kos38 7mo ago[dead]
- Shorel 7mo agoWe all should do our part to move to IPv6, the sooner, the better.
- hnarn 7mo agoThere are about 60k ports you can choose from for each IP, so I don’t understand why you can’t just give one user 1.2.3.4:1001 and the other 1.2.3.4:1002 and route that. Setting it up like this where you just assume: > The public key tells us the user, and the {user, IP} tuple uniquely identifies the VM they are connecting to. Seems like begging for future architectural problems.
- JSR_FDED 7mo agoThen you need a firewall update for each new user. Whereas matching on user+ip is a one-time proxy install.
- bombcar 7mo agoSomething like getting SSH to support SRV records would allow that to be transparent to the user: https://github.com/Crosse/sshsrv https://github.com/Crosse/sshsrv
- GoblinSlayer 7mo agoHost header is poorly designed builtin socks5 protocol. Use proper socks5 protocol. Its intended purpose is proxy access to inner networks, which became ubiquitous with this docker/kube/microservice thing.
- kazinator 7mo ago> SSH, on the other hand, has no equivalent of a Host header. SSH cannot multiplex to different servers on the same host:port. But you can use multiple ports and forwarding. You could give each machine a port number instead of a host name: ssh-proxy:10001 ssh-proxy:10002 When you ssh to "ssh-proxy:10002" ("ssh -p 10002 ssh-proxy" wth your OpenSSH client that doesn't take host:port, sigh), it forwards that to wherever the 10002 machine currently is. It would be interesting to know why they rejected the port number solution, but the only hit for "port" in the article is in the middle of the word "important" in the sentence: But uniform, predictable domain name behavior is important to us, so we took the time to build this for exe.dev. You can have uniform, predictable domain + port behavior. Then you don't need a smart proxy which routes connections based on identities like public keys. Just manipulation of standard port forwarding (e.g. iptables).
- mritzmann 7mo agoWhy not "ssh undefined-behavior@exe.xyz" (naming based on the example in the blog)? That way, you would have the "Host header" as username.
- tobwen 7mo agoIsn't this solving the problem? https://github.com/balena-io/sshproxy https://github.com/balena-io/sshproxy
- nishchayv_80 7mo ago[dead]
- BobbyTables2 7mo agoAnd what happens when two different users have the same public key?
- BobbyTables2 7mo agoHow many undiscovered vulnerabilities does your implementation have?