Hacker News Reader

Comment by schmichael | Hacker News Reader

The ProxyJump (-J) and Include directive features are huge! Really improves a lot of workflows where a tool like gcloud autoconfigures hosts in your SSH config (and could now do so with a bastion host easily).

A bit ironic openssh.com doesn't have HTTPS: http://www.openssh.com/txt/release-7.3

Edit: corrected typo!

View on HN

I think ProxyJump is a nice way to explicitly state that you want to jump hosts, but this is currently possible with ProxyCommand, such as the following...

  Host appserver1
    ProxyCommand ssh bastionhost.com -W %h:%p

The announcement already mentions that ProxyJump is meant to be a simplified version of indirection, not a completely new feature.

  commit ed877ef653847d056bb433975d731b7a1132a979
  Author: djm@openbsd.org <djm@openbsd.org>
  Date:   3 weeks ago

      upstream commit
    
      Add a ProxyJump ssh_config(5) option and corresponding -J ssh(1)
      command-line flag to allow simplified indirection through a
      SSH bastion or "jump host".
    
      These options construct a proxy command that connects to the
      specified jump host(s) (more than one may be specified) and uses
      port-forwarding to establish a connection to the next destination.
    
      This codifies the safest way of indirecting connections through SSH
      servers and makes it easy to use.
    
      ok markus@
    
      Upstream-ID: fa899cb8b26d889da8f142eb9774c1ea36b04397

That only sends commands via the proxy host. Jump allows you to connect to remote hosts via the jump host intermediary.

> A bit ironic openssh.com doesn't have HTTPS

You can however access the release notes (or any other file/page from the website for that matter) over SSH using CVS

    $ cvs -d anoncvs@anoncvs.ca.openbsd.org:/cvs get www/openssh/txt/release-7.3

Unless you've gotten anoncvs.ca.openbsd.org's host key fingerprint through some secure mechanism (say... HTTPS), SSH only encrypts the transport. It does nothing to stop a MITM (eg a malware injecting proxy).

Get the host fingerprints over TLS then?

https://www.openbsd.org/anoncvs.html

In which case ISTM that they could have just enabled HTTPS on www.openssh.com and saved us a few steps.

Reply on news.ycombinator.com