Hacker News Reader

Are there really ssh bastions which allow arbitrary command execution? This seems dangerous.

Limiting remote commands to port forwarding only will severely hamper this kind of attack, and will prevent ForwardAgent hacks as well.

View on HN

Even if you disallow command execution on the bastion (good idea), this will still allow an attacker to pivot to servers behind the bastion. The whole point being that the strong auth (e.g. MFA) enforced by the bastion is a roadblock to pivoting.

SSH bastions fall victim to feature creep like a lot of products

Reply on news.ycombinator.com