Remix.run Logo
akshayrajeshwar 16 hours ago

> If a zero-day drops in OpenSSH...

Realistically, fwknop is more likely to have a vuln than OpenSHH. Last release was two years ago and the readme dates back twelve :/ Time will tell.

mmh0000 16 hours ago | parent | next [-]

Seriously. If a zero-day drops in OpenSSH, it's quite literally the end of the world.

notpushkin 16 hours ago | parent | prev [-]

fwknop is a bit lower risk though. If all an attacker can do is open a port, they’ll still have to exploit OpenSSH.

akshayrajeshwar 16 hours ago | parent [-]

fwknop's default is to run as root, so there's that. Support for separation of privileges is still pending since 2013 (https://github.com/mrash/fwknop/issues/32)

notpushkin 15 hours ago | parent [-]

Good point, thanks.