In all seriousity, I would love a similar SSH server that automatically uses keys from GitHub for authentication. Great for setting up a little private git server without fiddling with keys.
Show HN: My SSH server knows who you are
21–30 of 257 posts
Re: Show HN: My SSH server knows who you are
#22Pretty interesting. Although it couldn't find my github ssh keys for some reason. Maybe the database has some stale entries? I imagine it's quite a lot of user data to go through and process.
Re: Show HN: My SSH server knows who you are
#23The connection gets closed immediately for me, what is it supposed to do?
For those who couldn't make it work: +---------------------------------------------------------------------+ | | | _o/ Hello! | | | | | | Did you know that ssh sends all your public keys to any server | | it tries to authenticate to? You can see yours echoed below. | | | | We tried to use that to find your GitHub username, but we | | couldn't :( maybe you don't even have GitHub ssh keys, do you? | | | | By the way, d…
And for those that want to see what a successful key check looks like:
+---------------------------------------------------------------------+
| |
| _o/ Hello Evan Tschuy!
| |
| |
| Did you know that ssh sends all your public keys to any server |
| it tries to authenticate to? |
| |
| That's how we know you are @tschuy on GitHub!
| |
| Ah, maybe what you did't know is that GitHub publishes all users' |
| ssh public keys and Ben (benjojo.co.uk) grabbed them all. |
| |
| That's pretty handy at times :) for example your key is at |
| https://github.com/tschuy.keys
| |
| |
| P.S. This whole thingy is Open Source! (And written in Go!) |
| https://github.com/FiloSottile/whosthere |
| |
| -- @FiloSottile (https://twitter.com/FiloSottile) |
| |
+---------------------------------------------------------------------+
Re: Show HN: My SSH server knows who you are
#24Forgive me ignorance here but what steps should I take to avoid someone from getting my public key off github and then using it to screw with my repos? Was there a major step I missed here when I made these keys?
No, in order to mess with your repo, an attacker would need your private key. Github only publishes public keys. For more information you can check out https://en.wikipedia.org/wiki/Public-key_cryptography
Oh yea, duh. Thanks for clearing that up for me, I get the two mixed up a lot. (which is bad)
Re: Show HN: My SSH server knows who you are
#25Good thing I use HTTP to push to Github (or not?)
no. you should use an ssh key w/ password. more secure and easier. your public key is designed to be public.
Re: Show HN: My SSH server knows who you are
#26Does the server get the client's public key before or after the client has identified the server? I suspect it's after - which would imply that this is much less harmful than it looks like, since by then you've already confirmed the identity of the server.
So if my assumption is correct (some quick googling for images of the ssh key exchange suggests it is), then the reason it "works" in this case is because people intentionally say "yes" when presented with the fingerprint, just to see what would happen. If you were ssh-ing to a server that you've used before, there is little to worry about because the ssh client first authenticates the server, and the server presumably needs to know who you are anyway.
Re: Show HN: My SSH server knows who you are
#27If this surprises people, it's definitely doing some good.
Nicely presented, Filippo!
Re: Show HN: My SSH server knows who you are
#28Found me; very nice. I wouldn't have guessed how you did it without the explanation about GitHub.
I wonder if this means we should be rotating keys periodically? I know most companies require users to rotate their password every X days.
Also, does GitHub have a setting to disable public key publishing?
Re: Show HN: My SSH server knows who you are
#29I use putty, this failed.
Strictly speaking, it didn't fail; PuTTY on Windows works a bit differently from command-line ssh on OS X/Linux, and doesn't show you everything. It brings you directly to a "login as:" prompt after throwing up a dialog about missing/unknown keys. What you were supposed to see never made it to the screen.
Re: Show HN: My SSH server knows who you are
#30FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does)
If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.
In your .ssh/config, something like:
# Ignore SSH keys unless specified in Host subsection
IdentitiesOnly yes
# Send your public key to github only
Host github.com
IdentityFile ~/.ssh/id_rsa