Re: Inbound SSH allowed to be used with Code for i and other tools ?

Hello Richard,

Am 30.10.2024 um 19:51 schrieb Richard Schoen <richard@xxxxxxxxxxxxxxxxx>:

I'm hearing varying opinions because of potential security issues.

Was talking to a large insurance company yesterday and they asked best way to secure SSH. Currently they don't allow it so RDI only tool option for editing.

[…]

Would be interesting to see Mapepire and/or codefori server morphed into an appropriate server that wouldn't require an SSH connect.

Accustom yourself with the syntax of ~/.ssh/authorized_keys.

https://man.openbsd.org/sshd#AUTHORIZED_KEYS_FILE_FORMAT

You can configure further restrictions there, to the point that there is no interactive shell spawned at all. The ssh connection is then being used as a mere encrypted channel for your Mapepire and/or codefori talking over this channel to a client via stdin/stdout — not unlike inetd. (Note: I don't know those two products and thus I don't know how they can be exposed via ssh in this way.)

Pro:
- Access permission to the system is negotiated within ssh, through ssh-keys, no special authentication in the client code necessary.
- Transmission Channel is encrypted without any programming effort. No cumbersome manual certificate renews necessary.

Con:
- No protection against security holes in the server application, obviously. If someone managed to get "in", he's "in".
- Talking to different services within the same user profile on the server requires multiple ssh keys, so sshd knows what "command" to launch. Cumbersome to get right on the client side.

:wq! PoC