The sshproxy-dumpd service v2.1.1 receives SSH session data in clear, and the client is not authenticated. That can be fine if the network is trusted (ex: localhost), but not in all settings.
Here is a gradual list of improvements proposals:
- warn about this risk in
shproxy-dumpd documentation (doc/sshproxy-dumpd.txt)
- document a way to setup
sshproxy and ssh-proxy-dumpd an encrypted tunnel with forward secrecy, as an external solution. Maybe using ssh tunneling?
- implement encryption in the service itself (and the client) using TLS, with authentication of both server and client to each other
The
sshproxy-dumpdservice v2.1.1 receives SSH session data in clear, and the client is not authenticated. That can be fine if the network is trusted (ex: localhost), but not in all settings.Here is a gradual list of improvements proposals:
shproxy-dumpddocumentation (doc/sshproxy-dumpd.txt)sshproxyandssh-proxy-dumpdan encrypted tunnel with forward secrecy, as an external solution. Maybe using ssh tunneling?