3 ms·
Um, you realize that you're still relying on the mid-point SSHD to relay TCP packets without MITMing you though, right? The only reason ProxyCommand to tunnel
by scott_karana 12y ago
Um, you realize that you're still relying on the mid-point SSHD to relay TCP packets without MITMing you though, right?
The only reason ProxyCommand to tunnel SSH would be safe is because your local SSH uses authentication, and you would get the freaky WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED, IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! warning. (eg known_hosts)
Netcat and plain HTTP don't have an authentication layer, so if your proxy server is compromised, so is your plain traffic.
EDIT: see this other reply for another source: https://news.ycombinator.com/item?id=9428518 https://news.ycombinator.com/item?id=9428518