Re:SSH Brute Force – The 10 Year Old Attack That Still Persists
by JoachimSchipper on Monday July 15, 2013 @03:09PM
(#6047875)
I have considerably less faith in OpenVPN than you do. The "bastion host" concept is fine, but you can do this with SSH, near-transparently even (using ProxyCommand).
[ Parent
| on HN ]
Re:SSH Brute Force – The 10 Year Old Attack That Still Persists
by pbsdp on Monday July 15, 2013 @03:39PM
(#6048063)
Can you expand on why? OpenVPN has long been an example of solid development (and crypto) practices.
As far as the bastion host, you need an actual VPN to do more than forward SSH connections. For instance, connectivity to your LDAP server, internal web services, etc.
Port forwarding gets you part of the way there, but it's inconvenient to use with SSL, requires using weird local port numbers when connecting to services, etc.
SSH does have VPN support via tun/tap, but it's not nearly as functionally complete as OpenVPN, and you still have the entire SSH authentication path exposed to the world.
Re:SSH Brute Force – The 10 Year Old Attack That Still Persists
by JoachimSchipper on Monday July 15, 2013 @04:04PM
(#6048216)
OpenSSH has long been an example of solid development (and crypto) practices too, and has had a few less issues. Search for "Use constant time memcmp when comparing HMACs in openvpn_decrypt." (the fix is my colleague's, but the bug was mine.)
That said, both are very good, and if you do want a full VPN there's a lot to recommend OpenVPN.