Connecting Terminals to Untrusted Servers

I recently thought about risks when connecting to an untrusted SSH server. For example a badly maintained server you’re supposed to do work on. This is what I came up with.

This is made with SSH in mind. But it may also apply to other methods of connecting terminals like serial connections or Telnet.

Using Wayland would be a benefit here. But it would need another terminal application instead of xterm. And for the moment I’m still an X11 person.

#!/bin/bash

# License: AGPLv3


SRV_ADDR="${1}"
# e.g.: '-p50022 root@127.0.0.1'

LC_ALL=C setsid --fork xterm \
  -xrm 'XTerm*allowTitleOps: false' \
  -xrm 'XTerm*allowFontOps: false' \
  -xrm 'XTerm*allowTcapOps: false' \
  -xrm 'XTerm*allowColorOps: false' \
  -xrm 'XTerm*fontDoublesize: false' \
  -xrm 'XTerm*allowMouseOps: false' \
  -xrm 'XTerm*VT100.translations: #override Ctrl Shift C: copy-selection(CLIPBOARD) \n'\
'Ctrl Shift V: insert-selection(CLIPBOARD)' \
  -fn 9x15 \
  -maximized \
  -e 'bwrap '\
'   --unshare-all --share-net --die-with-parent '\
'   --ro-bind /usr /usr '\
'   --symlink /usr/lib /lib '\
'   --symlink /usr/lib64 /lib64 '\
'   --ro-bind /etc/ld.so.cache /etc/ld.so.cache '\
'   --ro-bind /etc/resolv.conf /etc/resolv.conf '\
'   --ro-bind /etc/passwd /etc/passwd '\
'   --dev /dev '\
'   --dir "${HOME}/.ssh" '\
'   --ro-bind "${HOME}"/.ssh/id_ed25519_untrusted-server '\
'     "${HOME}"/.ssh/id_ed25519_untrusted-server '\
'   --clearenv --setenv HOME "${HOME}" --setenv TERM "${TERM}" -- '\
'     ssh -i ~/.ssh/id_ed25519_untrusted-server '\
'     -F /dev/null -ax -o SetEnv=LC_ALL=C '\
'     -o PasswordAuthentication=no '\
'     -o KbdInteractiveAuthentication=no '\
'     -o UpdateHostKeys=no '\
'     '"${SRV_ADDR}"' || cat'
# no extra quotes around SRV_ADDR to expand it