I am fairly glad I have stuck with stock OpenSSH that ships with Linux. This incident proves I am glad with that choice.
Over the decades, I have maintained remote access through port forwarding on my router - at one point in 2008 I put SSH on port 80 so I could access it from the restricted wifi network at the hospital my grandmother was at. I have also used openvpn. I have also used cloudflare tunnels. But in the end, I always connect to hardened openssh with key only authentication.
I gather the bug allows people you've explicitly authorized to ssh into some account on your machine, to access more than that account can. So if you only use ssh yourself, or only give ssh keys for users with sudo, or only to people you trust not to exploit this, or if other vulnerabilities allow local shell users to escalate, or if you only use tailscale for port forwarding, then you're unaffected. Arguably even less exposed than a public openssh instance, though I can't say I have any issue doing that
Privilege escalation is now nothing to worry about?
Privilege escalation is nothing to worry about on root accounts
I guess if you have an industrial arm connected then they could escalate to physical access
The "root account" is your assumption now no?
I'm with you- the attack surface of openssh (and my trust in damien) is a better match imo
Doing ssh through port 80 or 53 or 443 is immediately flagged.
I understand port 443 is always opened but nowadays you can’t just run ssh traffic on 443 without it being detected as not being https
A lot of networks still just do dumb port blocking. Yes, any network that is making a serious effort to prevent ssh will succeed. But a lot aren't.
Flagged by who? The Internet Police? This comment is absurd.
By restricted networks, like hospitals, workplaces, schools, etc.
If their firewalls can detect it not being typical http/s traffic, they can block it.
I run WireGuard VPN on port 443 UDP. Many times I can connect to that from various public WiFi networks like coffee shops and public libraries. And then I ssh into my machines at home over my self-hosted VPN.
I’ve been hoping that HTTP3 adoption would make 443 UDP accessible from even more places. But maybe they already do the kind of thing you said for that too, looking at the traffic flow to determine that it is not HTTPS.
Weirdly sometimes there are WiFi networks where I am not able to connect to my WireGuard VPN on 443 UDP, but I can connect to servers over ssh on standard port 22 TCP. Perhaps they sometimes block all UDP traffic because they don’t want people to use BitTorrent etc, but one would think that with all the online meeting platforms that do video streaming there would be a lot of problems for people if all UDP traffic was blanket blocked.
I might eventually try out AmneziaWG instead of vanilla WireGuard, but at the moment I am fine not being able to Connect to my VPN sometimes. I only use it to connect to my other machines anyway, not as a VPN tunnel for my web browsing etc.
it's possible commercial routers such as the ones utilized by restaurants allow wireguard through these days? wireguard makes no effort to be stealthy when emitting.
some VPN apps bypass wireguard blocks automatically by using https tunnels and whatnot.
It worked in 2008 - 18 years ago. I have other options now like said cloudflare tunnel.
Does mosh help with it? Seems to be based on udp, and it looks good. I am not entirely sure if it helps the issue that you are talking about so hoping for someone more experienced to chime in
https://mosh.org/
Naive. There's not much that prevents you from running ssh over https. Not even traffic patterns will give you up in the age of ubiquitous websockets and/or http2 streams.
Even with corporate MITM setups? I somehow doubt it..
No need for MITM.
DPI immediately can tell it is ssh.
"Naive”. How ironic.