starred/the-bastion

Fork 0

mirror of https://github.com/ovh/the-bastion.git synced 2026-05-09 16:35:33 +02:00

[GH-ISSUE #376] connect to remote host with vscode ssh extension #102

New issue

Open

opened 2026-05-07 00:18:55 +02:00 by BreizhHardware · 9 comments

BreizhHardware commented

2026-05-07 00:18:55 +02:00

Owner

Originally created by @ksourdrille on GitHub (Mar 19, 2023).
Original GitHub issue: https://github.com/ovh/the-bastion/issues/376

Hello,

Do you know if there is a way to connect to the remote host with vscode ssh extension trought the bastion ?

i saw we can't use proxy jump and proxy command, but i don't know if someone already done this without this commands.

Kélian

Originally created by @ksourdrille on GitHub (Mar 19, 2023). Original GitHub issue: https://github.com/ovh/the-bastion/issues/376 Hello, Do you know if there is a way to connect to the remote host with vscode ssh extension trought the bastion ? i saw we can't use proxy jump and proxy command, but i don't know if someone already done this without this commands. Kélian

BreizhHardware commented

2026-05-07 00:18:56 +02:00

Author

Owner

@speed47 commented on GitHub (Mar 21, 2023):

Hello,

I'll have to look into it more deeply, but there are chances it won't work, unfortunately.

This is because the Remote SSH extension of vscode uses the -D option of ssh, which opens a local port that talks the SOCKS4/5 protocol, and tunnels it to the server, enabling unfiltered and unlogged access to any remote party accessible from the server itself. This is a variant of the -L and -R option, which uses SOCKS instead of forwarding a single port.

Obviously this is very handy for dev environments and several other use cases, but this would break the auditability, traceability and authorization check mechanisms of the bastion, as you can tunnel and potentially access other things that the bastion won't have a chance to see, hence not able to allow, deny, or even log. The protocol break done on the bastion side is actually done to prevent this kind of loophole, among other things.

Now, this use case on a bastion reserved to dev environments and flagged as such in a more global security policy, might be legit, as long as it's explicitly allowed, but again I'll have to look into it, as I'm not sure this can be done, given the design of the bastion. There's apparently a mode that can be enabled in the Remote SSH extension that can use -L instead of -D, by forwarding a UNIX socket instead of forwarding a port, I'll try to look into that.

@speed47 commented on GitHub (Mar 21, 2023): Hello, I'll have to look into it more deeply, but there are chances it won't work, unfortunately. This is because the Remote SSH extension of vscode uses the `-D` option of `ssh`, which opens a local port that talks the SOCKS4/5 protocol, and tunnels it to the server, enabling unfiltered and unlogged access to any remote party accessible from the server itself. This is a variant of the `-L` and `-R` option, which uses SOCKS instead of forwarding a single port. Obviously this is very handy for dev environments and several other use cases, but this would break the auditability, traceability and authorization check mechanisms of the bastion, as you can tunnel and potentially access other things that the bastion won't have a chance to see, hence not able to allow, deny, or even log. The protocol break done on the bastion side is actually done to prevent this kind of loophole, among other things. Now, this use case on a bastion reserved to dev environments and flagged as such in a more global security policy, might be legit, as long as it's explicitly allowed, but again I'll have to look into it, as I'm not sure this can be done, given the design of the bastion. There's apparently a mode that can be enabled in the Remote SSH extension that can use `-L` instead of `-D`, by forwarding a UNIX socket instead of forwarding a port, I'll try to look into that.

BreizhHardware commented

2026-05-07 00:18:56 +02:00

Author

Owner

@speed47 commented on GitHub (Mar 23, 2023):

Actually, had a look yesterday, and I might have a PoC with -L that roughly seems to work, but it would need to be tested by people using vscode daily. Would you be interested to test it?

@speed47 commented on GitHub (Mar 23, 2023): Actually, had a look yesterday, and I might have a PoC with `-L` that roughly seems to work, but it would need to be tested by people using vscode daily. Would you be interested to test it?

BreizhHardware commented

2026-05-07 00:18:56 +02:00

Author

Owner

@ksourdrille commented on GitHub (Mar 23, 2023):

Hi @speed47, Thanks for your answer and your time :)

of course I am interested :)

What should I do?

Kélian

@ksourdrille commented on GitHub (Mar 23, 2023): Hi @speed47, Thanks for your answer and your time :) of course I am interested :) What should I do? Kélian

BreizhHardware commented

2026-05-07 00:18:57 +02:00

Author

Owner

@ksourdrille commented on GitHub (Apr 8, 2023):

Hi @speed47,

Do you have any news for me?

Kélian

@ksourdrille commented on GitHub (Apr 8, 2023): Hi @speed47, Do you have any news for me? Kélian

BreizhHardware commented

2026-05-07 00:18:57 +02:00

Author

Owner

@speed47 commented on GitHub (Apr 11, 2023):

Yes, I'll be writing the documentation this week. There is one major drawback, unfortunately: due to an OpenSSH bug that is known since at least 2016 but still unfixed (!), one has to enable local port forwarding on the bastion for the vscode plugin to work (even if it doesn't actually require local port forwarding), so that's something to have in mind. It's not really a good practice to enable this on a bastion, but it might be acceptable for dev environments (if you have a separate bastion for production environments, for example).

I'll outline this in the documentation. Stay tuned.

@speed47 commented on GitHub (Apr 11, 2023): Yes, I'll be writing the documentation this week. There is one major drawback, unfortunately: due to an OpenSSH bug that is known since at least 2016 but still unfixed (!), one has to enable local port forwarding on the bastion for the vscode plugin to work (even if it doesn't actually require local port forwarding), so that's something to have in mind. It's not really a good practice to enable this on a bastion, but it might be acceptable for dev environments (if you have a separate bastion for production environments, for example). I'll outline this in the documentation. Stay tuned.

BreizhHardware commented

2026-05-07 00:18:57 +02:00

Author

Owner

@ksourdrille commented on GitHub (Apr 12, 2023):

Hello,

Ok thank you for all :)

Kélian

@ksourdrille commented on GitHub (Apr 12, 2023): Hello, Ok thank you for all :) Kélian

BreizhHardware commented

2026-05-07 00:18:58 +02:00

Author

Owner

@ksourdrille commented on GitHub (May 23, 2023):

Hi @speed47

Do you somes good news about this topic ?

Kélian

@ksourdrille commented on GitHub (May 23, 2023): Hi @speed47 Do you somes good news about this topic ? Kélian

BreizhHardware commented

2026-05-07 00:18:58 +02:00

Author

Owner

@Pierrelefort commented on GitHub (Dec 22, 2023):

I've also attempted to connect to a remote host using the SSH extension without any luck.
If there are any updates or if there's an opportunity for me to lend a hand in debugging, I'd greatly appreciate the information.

@Pierrelefort commented on GitHub (Dec 22, 2023): I've also attempted to connect to a remote host using the SSH extension without any luck. If there are any updates or if there's an opportunity for me to lend a hand in debugging, I'd greatly appreciate the information.

BreizhHardware commented

2026-05-07 00:18:58 +02:00

Author

Owner

@pawcykca commented on GitHub (Nov 18, 2024):

Hi @speed47, did you manage to prepare the mentioned documentation somewhere?
I have tried to setup vscode wit ssh-remote extensiob but I stuck on connecting to installed vscode via bation.

@pawcykca commented on GitHub (Nov 18, 2024): Hi @speed47, did you manage to prepare the mentioned documentation somewhere? I have tried to setup vscode wit ssh-remote extensiob but I stuck on connecting to installed vscode via bation.