Skip to content

sshproxy-dumpd: protect traffic using encryption and client authentication #75

Description

@dolmen

The sshproxy-dumpd service v2.1.1 receives SSH session data in clear, and the client is not authenticated. That can be fine if the network is trusted (ex: localhost), but not in all settings.

Here is a gradual list of improvements proposals:

  1. warn about this risk in shproxy-dumpd documentation (doc/sshproxy-dumpd.txt)
  2. document a way to setup sshproxy and ssh-proxy-dumpd an encrypted tunnel with forward secrecy, as an external solution. Maybe using ssh tunneling?
  3. implement encryption in the service itself (and the client) using TLS, with authentication of both server and client to each other

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions