Consider a wireguard network of many clients which all interact with each other through a central hub server on a cloud VPS. One of the clients is a desktop used for SSHing into the other various clients–again, through the central hub. If the “terminal” client connects to another client through the wireguard hub using SSH public/private key authentication, what if any information within that SSH tunnel gets exposed or leaked to the “hub” server?
My threat model is if the VPS was to ever get compromised. I previously SSH’d into the hub VPS server and from there I would SSH into any of the other clients with a password. Horrible security, I know.
My new setup is as mentioned above. Only the single desktop client has key authentication to SSH into the various clients. But I want to be sure none of that data gets exposed to the VPS hub just in case.
There should be no leaking through SSH. SSH connects directly with your targeted client. From the hub you can only see that the communication protocol is SSH but not what is transmitted.
If the host you’re connecting to is already in your known_hosts, a malicious network can’t do anything but break the connection. If it tries to mitm the ssh connection, you’ll get the alert that’s someone could be “doing something nasty”.
Information leakage: Anything between you and the ssh server will be able to see that you’re connecting to a ssh server and how much data you transfer, but not what the data actually is.