nassh-relay

Looks like Google's BeyondCorp: https://cloud.google.com/beyondcorp. If you are on GCP, you can already use it https://cloud.google.com/iap to protect your HTTP and TCP backend. This is not something new. The earliest open source project that I can recall is https://github.com/bitly/oauth2_proxy (albeit it might be missing the part where proxy passing identity to the backend). Pomerium is another open source project that's actively maintained. I've been using it as a reverse proxy to all my homelab websites (grafana, miniflux etc). I can now safely access all of these internal resources from outside of my home WiFi with automated SSL certificate configuration and renewal. You can theoretically protect your SSH connection via these IAP proxies, using the Chrome SSH extension and open source SSH relay implementation like https://github.com/

having cloudflare in front is even better than just DDNS: you can hide your origin ip and avoid being DOSed. I then use chrome's ssh extension with nassh-relay[1] to ssh, allowing me to not ever need to know the ip of my machine. I have a modified version of docker-cloudflare[2] that also emails me when re-iping occurs (~once a year), just in case. [1] https://github.com/zyclonite/nassh-relay [2] https://github.com/joshuaavalon/docker-cloudflare

Chrome OS has no native SSH client, but Google published a NaCL based SSH client: https://chrome.google.com/webstore/detail/secure-shell/pnhec... It's useful outside of Chrome OS if you have a security perimeter based on TLS with ACLs and auditing already in place and you want to use it for SSH as well: https://github.com/zyclonite/nassh-relay https://chromium.googlesource.com/chromiumos/platform/assets... Google uses a similar setup internally.