3 ms·

Question by someone who has no real knowledge about the ssh protocol - is using something like this secure? And if not, what can be done to make their implement

• jerf 12y ago
  That's really hard to answer. On the other hand, OpenSSH's server has become so big that even when it is perfectly implementing the security contract its authors intend it can still allow users to do things that may surprise the heck out of you. Given what I've seen of trying to secure things that use SSH and really shouldn't, I would believe it might be easier to audit your own server rather than a deployment of opensshd.
• _Soulou 12y ago
  As jerf said, it's always difficult to see if an implementation of a protocol respects it completely. Most of us trust OpenSSH because of its background. It's old enough, the codebase is mature enough and maintained by the OpenBSD team. However it's quite a massive project, I don't know how they would be able that their implementation fits completely the 6 RFCs, I mean, more than the go implementation. In our case, the SSH server is not for general purpose, but for something really specific, so it's really easier to test. What other feature? As I will explain next week, our SSH server is actually an authentication/autorization proxy which forwards connections to another server. By building our solution, it is now easier to control the logics for the load balancing etc.