5 ms·
I'm moving towards this for my current workplace. SSH will only be allowed via VPN, only to a bastion, and that bastion will not permit agent forwarding, or re
by aarmenaa 3y ago
I'm moving towards this for my current workplace. SSH will only be allowed via VPN, only to a bastion, and that bastion will not permit agent forwarding, or really much of anything other than ProxyJump. I'm baffled that agent forwarding is a feature when OpenSSH won't even use a key file if the permissions are wrong.
- lxgr 3y agoAgent forwarding has its uses; not all of them can be replaced by ProxyJump.
- GauntletWizard 3y agoI never need to SSH directly into servers. When I do, I need to be able to clone private git repos. ssh agent forwarding is the right answer.
- sureglymop 3y agoTo go further, use a VPN that uses UDP and only allow that connection after port knocking three randomly chosen ports.
- ThePowerOfFuet 3y agoThis is way overkill when you could simply use Wireguard instead.
- sureglymop 3y agoNot really, its just a few lines in your nftables/iptables rules. And sure, wireguard is great. It's just an underrated trick from decades ago. :)