I need some help understanding the security implications of using a service like ngrok to setup an ssh connection.
I've got two computers without public IP addresses (both using mobile internet connections) so I can't ssh directly from computer A to computer B. I've created an account with ngrok to create a tunnel between my two computers. On computer A I reverse SSH into ngrok's service as described on page https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent/, ie
- I generated an ssh key pair on computer A,
- uploaded the public key to ngrok, and
- ran ssh -R 0:localhost:22 [email protected] tcp 22 (I'm not actually using port 22).
My understanding is that this is a one-way connection, ie ngrok's service has no access to computer A, is that correct? (if it can, computer A only permits login via ssh keys, which should make it hard to get access)
On computer B I ssh into the port and server given to me on ngrok's dashboard. Again, my understanding is that ngrok does not have access to computer B, is that correct?
ngrok then (somehow) bridges the connection between the two ssh connections, such that computer B gets to talk directly to computer A. (Is there a security risk?)
Since I have ssh keys set up computer B gets directly connected to computer A without any password request (I explicitly disabled ssh password logins on computer A).
Based on my (very rough) understanding of ssh, I wouldn't think that ngrok (or somebody potentially compromising ngrok) could gain access to either of my computers, is that correct? Is there any way the connection between computers A and B can be compromised (apart from brute-forcing the keys)?
