Re: Inbound SSH allowed to be used with Code for i and other tools ?

Thanks for the reply Patrik.

I didn't realize there were all those extra things you can add to an authorized_keys file.

Interesting about not allowing interactive shell to spawn.

What would be really cool is if there were exit points that could be monitored to limit which commands could be executed.

Since IBM put together this version of OpenSSH why not make it better and more securable.

Probably a wish that won't come true, but worth pontificating.

Regards,
Richard Schoen
Web: http://www.richardschoen.net
Email: richard@xxxxxxxxxxxxxxxxx
------------------------------

message: 3
date: Thu, 31 Oct 2024 01:31:17 +0100
from: Patrik Schindler <poc@xxxxxxxxxx>
subject: Re: Inbound SSH allowed to be used with Code for i and other
tools ?

Hello Richard,

Am 30.10.2024 um 19:51 schrieb Richard Schoen <richard@xxxxxxxxxxxxxxxxx>:

I'm hearing varying opinions because of potential security issues.

Was talking to a large insurance company yesterday and they asked best way to secure SSH. Currently they don't allow it so RDI only tool option for editing.

[?]

Would be interesting to see Mapepire and/or codefori server morphed into an appropriate server that wouldn't require an SSH connect.

Accustom yourself with the syntax of ~/.ssh/authorized_keys.

https://man.openbsd.org/sshd#AUTHORIZED_KEYS_FILE_FORMAT

You can configure further restrictions there, to the point that there is no interactive shell spawned at all. The ssh connection is then being used as a mere encrypted channel for your Mapepire and/or codefori talking over this channel to a client via stdin/stdout ? not unlike inetd. (Note: I don't know those two products and thus I don't know how they can be exposed via ssh in this way.)

Pro:
- Access permission to the system is negotiated within ssh, through ssh-keys, no special authentication in the client code necessary.
- Transmission Channel is encrypted without any programming effort. No cumbersome manual certificate renews necessary.

Con:
- No protection against security holes in the server application, obviously. If someone managed to get "in", he's "in".
- Talking to different services within the same user profile on the server requires multiple ssh keys, so sshd knows what "command" to launch. Cumbersome to get right on the client side.

:wq! PoC