Unixwiz

> Teleport handles the auth at its entry point, so you don't need a keypair for every node in your cloud. Just one for Teleport.

From ssh(1):

-J destination
Connect to the target host by first making a ssh connection to
the jump host described by destination and then establishing a
TCP forwarding to the ultimate destination from there. Multiple
jump hops may be specified separated by comma characters. This
is a shortcut to specify a ProxyJump configuration directive.

Auth to the jump/bastion host and then have key(s) on that, or tunnel back the internal auth requests over to your desktop via ssh-agent(1) forwarding:

* http://www.unixwiz.net/techtips/ssh-agent-forwarding.html#fwd

* https://www.cloudsavvyit.com/25/what-is-ssh-agent-forwarding-and-how-do-you-use-it/

I think C declaration syntax is a bit of an acquired taste --- it looks confusing at first but once you "get" it everything falls into place and it feels completely natural. Arguments that it is difficult to read because it is not "left to right" contrast with the fact that the expression syntax is not "left to right" either in most programming languages; 2 + 3 * 4 parses as 2 + (4 * 3) in most languages that use this syntax.

Also worth mentioning that the "clockwise/spiral rule" that this article links to for reading C declarations is actually wrong, as Linus Torvalds helpfully points out here: https://plus.google.com/111049168280159033135/posts/1ZhdNwbjcYF

This is probably a better article for understanding them: http://www.unixwiz.net/techtips/reading-cdecl.html

The default settings are bad for the majority of sysadmins. See http://unixwiz.net/techtips/ssh-agent-forwarding.html#sec

With the ssh-agent defaults, if I have root/sudo access on a server you are logged into with ssh on, I practically have free use of your private SSH key.

I use gpg's ssh-agent emulation (See the man page for gpg-agent under --enable-ssh-support), and store my ssh private key on my yubikey. With this setup, the yubikey's light flashes when something wants to use my private key, and you can just touch the button on it to approve.

I agree with everything except using ssh-agent to forward the key. The reason is that if that one server is compromised, the root user can forward your credentials to any other server that you have access to and if it is set up the same way, also get root there. If you use password for sudo authentication on that machine, they have your password but still don't have your credentials to get into the other server. Reference: http://unixwiz.net/techtips/ssh-agent-forwarding.html

Definitely subjective. It's easy to argue that it's actually the C family of languages that have a backwards declaration syntax - in case of complex declarations, not just backwards but completely crazy inside-out zigzag [1]. Yes, there's a logic in it, but it's definitely not intuitive. On the other hand, the "type-on-the-right" syntax is quite popular outside the C family. Pascal, Ada, Go, Scala, Rust...

[1] http://www.unixwiz.net/techtips/reading-cdecl.html

The original vuln that invited in this kludge:

http://unixwiz.net/techtips/iguide-kaminsky-dns-vuln.html

The solution to this kludge?

> What has ANSSI done to improve the security of the DNS?

> ANSSI led a 4 months alert campaign, warning DNS software vendors and critical DNS operators (such as the root operators and several TLD operators).

aka, nothing, more kludge, push complexity off onto clients.