I am fairly glad I have stuck with stock OpenSSH that ships with Linux. This incident proves I am glad with that choice.
Over the decades, I have maintained remote access through port forwarding on my router - at one point in 2008 I put SSH on port 80 so I could access it from the restricted wifi network at the hospital my grandmother was at. I have also used openvpn. I have also used cloudflare tunnels. But in the end, I always connect to hardened openssh with key only authentication.
I gather the bug allows people you've explicitly authorized to ssh into some account on your machine, to access more than that account can. So if you only use ssh yourself, or only give ssh keys for users with sudo, or only to people you trust not to exploit this, or if other vulnerabilities allow local shell users to escalate, or if you only use tailscale for port forwarding, then you're unaffected. Arguably even less exposed than a public openssh instance, though I can't say I have any issue doing that
loading story #50269874
I'm with you- the attack surface of openssh (and my trust in damien) is a better match imo
Doing ssh through port 80 or 53 or 443 is immediately flagged.
I understand port 443 is always opened but nowadays you can’t just run ssh traffic on 443 without it being detected as not being https
loading story #50266782
loading story #50267559