Hacker News Reader

Comment by zobzu | Hacker News Reader

Its nice.. That said, one if the real issue is getting people to use -W ;)

I'm looking at the man page, I had no idea about `-W`. However, what does this protect against that the standard:

    ProxyCommand ssh -q <jumpHost> nc %h 22

doesn't protect?

Edit: just tried `-W` as an addition to the line but I get

   littlefish :: ~ » ssh pgsql3
   Bad stdio forwarding specification '<jumpHost>'
   ssh_exchange_identification: Connection closed by remote host

sshmux gives fine-grained user controls. In the normal jumphost example, you can use ssh -W to connect to arbitrary ports and hosts on the network, poking around where you weren't intended (ssh -W is just netcat where the ssh server initiates the connection for you). With sshmux, ssh -W will only work to hosts permitted for that user, and any other request will just fail.

Try formatting it like this:

    ProxyCommand ssh jumpHost -W %h:%p

-W is essentially the same as using nc, however it doesn't require executing a command on the jumphost. This project uses that fact to make the jumphost more secure (you can't execute arbitrary commands), and do destination white-listing for each user.

-W is just a nicer wait of doing your nc command

That's true. Some people complained that this isn't documented enough, so there is a wiki page for sshmuxd explaining what it does.

Agent forwarding with sshmux should be safer than the general case, though, as the agent is handled in memory, rather than as a socket. The agent is also not forwarded to the destination.

https://github.com/ryancdotorg/ssh-chain should just work with this.

Reply on news.ycombinator.com