11–20 of 257 posts
Forgive me ignorance here but what steps should I take to avoid someone from getting my public key off github and then using it to screw with my repos? Was there a major step I missed here when I made these keys?
ssh_dispatch_run_fatal: Connection to 178.32.139.168: no matching key exchange method found
kex: client->server aes128-gcm@openssh.com
I cleaned out .ssh/knownhosts after connecting.
+---------------------------------------------------------------------+
| |
| _o/ Hello! |
| |
| |
| Did you know that ssh sends all your public keys to any server |
| it tries to authenticate to? You can see yours echoed below. |
| |
| We tried to use that to find your GitHub username, but we |
| couldn't :( maybe you don't even have GitHub ssh keys, do you? |
| |
| By the way, did you know that GitHub publishes all users' |
| ssh public keys and Ben (benjojo.co.uk) grabbed them all? |
| |
| That's pretty handy at times :) But not this time :( |
| |
| |
| P.S. This whole thingy is Open Source! (And written in Go!) |
| https://github.com/FiloSottile/whosthere |
| |
| -- @FiloSottile (https://twitter.com/FiloSottile) |
| |
+---------------------------------------------------------------------+
Arams-MacBook-Pro:~ acomjean$ emacs .ssh/known_hosts
The connection gets closed immediately for me, what is it supposed to do?
+---------------------------------------------------------------------+
| |
| _o/ Hello! |
| |
| |
| Did you know that ssh sends all your public keys to any server |
| it tries to authenticate to? You can see yours echoed below. |
| |
| We tried to use that to find your GitHub username, but we |
| couldn't :( maybe you don't even have GitHub ssh keys, do you? |
| |
| By the way, did you know that GitHub publishes all users' |
| ssh public keys and Ben (benjojo.co.uk) grabbed them all? |
| |
| That's pretty handy at times :) But not this time :( |
| |
| |
| P.S. This whole thingy is Open Source! (And written in Go!) |
| https://github.com/FiloSottile/whosthere |
| |
| -- @FiloSottile (https://twitter.com/FiloSottile) |
| |
+---------------------------------------------------------------------+Neat. I wonder how many "attackers" that scan ssh etc. could be identified by this.
Forgive me ignorance here but what steps should I take to avoid someone from getting my public key off github and then using it to screw with my repos? Was there a major step I missed here when I made these keys?
No, in order to mess with your repo, an attacker would need your private key. Github only publishes public keys. For more information you can check out https://en.wikipedia.org/wiki/Public-key_cryptography
I use putty, this failed.
$ ssh whoami.filippo.io
The authenticity of host 'whoami.filippo.io (178.32.139.168)' can't be established.
RSA key fingerprint is c8:9a:b0:9d:59:96:24:37:70:4c:ef:eb:31:47:68:40.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'whoami.filippo.io,178.32.139.168' (RSA) to the list of known hosts.
+---------------------------------------------------------------------+
| |
| _o/ Hello Jason Hutchinson!
| |
| |
| Did you know that ssh sends all your public keys to any server |
| it tries to authenticate to? |
| |
| That's how we know you are @zikes on GitHub!
| |
| Ah, maybe what you did't know is that GitHub publishes all users' |
| ssh public keys and Ben (benjojo.co.uk) grabbed them all. |
| |
| That's pretty handy at times :) for example your key is at |
| https://github.com/zikes.keys
| |
| |
| P.S. This whole thingy is Open Source! (And written in Go!) |
| https://github.com/FiloSottile/whosthere |
| |
| -- @FiloSottile (https://twitter.com/FiloSottile) |
| |
+---------------------------------------------------------------------+
Connection to whoami.filippo.io closed.