OpenSSH 7.3 released

Re:OpenSSH 7.3 released by schmichael on Monday August 01, 2016 @11:58AM (#12203427)

The ProxyJump (-J) and Include directive features are huge! Really improves a lot of workflows where a tool like gcloud autoconfigures hosts in your SSH config (and could now do so with a bastion host easily).

A bit ironic openssh.com doesn't have HTTPS: http://www.openssh.com/txt/release-7.3

Edit: corrected typo!

[ Parent | on HN ]

Re:OpenSSH 7.3 released by idsout on Monday August 01, 2016 @12:08PM (#12203516)

I think ProxyJump is a nice way to explicitly state that you want to jump hosts, but this is currently possible with ProxyCommand, such as the following...

  Host appserver1
    ProxyCommand ssh bastionhost.com -W %h:%p

[ Parent | on HN ]

Re:OpenSSH 7.3 released by mineo on Monday August 01, 2016 @12:24PM (#12203669)

The announcement already mentions that ProxyJump is meant to be a simplified version of indirection, not a completely new feature.

[ Parent | on HN ]

Re:OpenSSH 7.3 released by jlgaddis on Monday August 01, 2016 @06:41PM (#12206628)

  commit ed877ef653847d056bb433975d731b7a1132a979
  Author: [email protected] <[email protected]>
  Date:   3 weeks ago

      upstream commit
    
      Add a ProxyJump ssh_config(5) option and corresponding -J ssh(1)
      command-line flag to allow simplified indirection through a
      SSH bastion or "jump host".
    
      These options construct a proxy command that connects to the
      specified jump host(s) (more than one may be specified) and uses
      port-forwarding to establish a connection to the next destination.
    
      This codifies the safest way of indirecting connections through SSH
      servers and makes it easy to use.
    
      ok markus@
    
      Upstream-ID: fa899cb8b26d889da8f142eb9774c1ea36b04397

[ Parent | on HN ]

Re:OpenSSH 7.3 released by matt_wulfeck on Sunday August 07, 2016 @12:18PM (#12242471)

That only sends commands via the proxy host. Jump allows you to connect to remote hosts via the jump host intermediary.

[ Parent | on HN ]

Re:OpenSSH 7.3 released by OrpheanBeholder on Monday August 01, 2016 @01:02PM (#12204031)

> A bit ironic openssh.com doesn't have HTTPS

You can however access the release notes (or any other file/page from the website for that matter) over SSH using CVS

    $ cvs -d [email protected]:/cvs get www/openssh/txt/release-7.3

[ Parent | on HN ]

Re:OpenSSH 7.3 released by schmichael on Monday August 01, 2016 @01:58PM (#12204493)

Unless you've gotten anoncvs.ca.openbsd.org's host key fingerprint through some secure mechanism (say... HTTPS), SSH only encrypts the transport. It does nothing to stop a MITM (eg a malware injecting proxy).

[ Parent | on HN ]

Re:OpenSSH 7.3 released by OrpheanBeholder on Monday August 01, 2016 @03:35PM (#12205244)

Get the host fingerprints over TLS then?

https://www.openbsd.org/anoncvs.html

[ Parent | on HN ]

Re:OpenSSH 7.3 released by jlgaddis on Monday August 01, 2016 @06:49PM (#12206666)

In which case ISTM that they could have just enabled HTTPS on www.openssh.com and saved us a few steps.

[ Parent | on HN ]