Is there any reason to worry about running tmux/wemux on a bastion host? It seems to me that it would open up vectors to have your terminal sessions hijacked by some locally exploited account on the bastion host, something that the bastion host would be less exposed to if it was only forwarding ssh sessions.

Or is that overly paranoid?


Since both tmux and wemux use their own server-like process and joining/authentication procedures, they inherently increase the so-called "attack surface": that's more code which may have bugs, and bugs can easily become vulnerabilities.

However, at least tmux has good repute, with, as far as this page says, was only ever affected by one known vulnerability, which was relatively minor (not a session hijack, but rights escalation into the utmp group). Wemux is more recent, which may warrant some extra caution.

A more pressing matter is that if users can run tmux on the host, then they can probably run arbitrary commands, which might be a problem if these users are hostile (to each other, or to the system in general), if only through simple DoS (e.g. a fork bomb). With forwarding-only, SSH can be "locked up" in a way which prevents evil users from being as much a nuisance to their peers. So it is not tmux that you should be mindful of, but the extent of the services that you wish to offer to your users -- a full shell account, that's a big offering.

| improve this answer | |

I have run screen on bastion hosts in the past but have been trying to get away from it for just the reason you mention. If the bastion host is intruded upon they can get access to all of your open sessions. So running screen/tmux on a bastion host is NOT recommended.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.