The vuln is specifically for key-based accounts:

Second, the target system account must be configured to be passwordless. Passwordless accounts are commonly used for accounts that use certificate-based authentication.

Am I having a stroke or is this hard to read?

Reading this while working for a division that pivoted to provide interfaces for agentic workflows, only to discover that only ten users had ever touched the products we made for agents, only to pivot again to support for agentic workflows, which has a lot of competition because every company has to do something agentic now and there’s only like four things you can do in that space, is bracing.

The context of this entire discussion is connecting to internal services; the kind you wouldn’t have in your DMZ, as that has no privileged access to your network.

Anyhoo, you do you, but I certainly wouldn’t make public a reverse proxy with access to my internals.

I think you might be drastically misunderstanding what a reverse proxy does.

Reverse proxy: Gives EVERY computer a direct connection to your network if you make it public, which it certainly sounds like you mean.

VPN: gives only you access to your internals.

In terms of connecting from work and not allowing some untrusted computer, there’s a hundred different options, even running portable QEMU from a USB and using that trusted virtual machine to connect.

Beginners can recycle an old mini/micro PC. You can buy refurbished ones from computer recyclers for like $15.

At both ends of the spectrum you can save money. The people who don’t (like me) are not doing it for the goal of saving money.