Embed Notice

@grumpybozo @clacke tunnel solely over VPN, ingress IP set in authorized_hosts and/or ip(6)tables, & to jailed lobby user (no root SSH, even with keys), whose $SHELL is rbash or so, only accessible binary in immutable path sudo, for escalation to root. Jailed VMs should be reached from host over SSH, not outside, no attack surface dilation with VNC, unless over VPN. Should be no VM<->VM traffic on bridge other than needed (like to MTA via VM), no traffic VM->host, other than through rev proxy