Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: My SSH server knows who you are

blog.filippo.io

Post reply on HN
Print view View original

31–40 of 257 posts

Re: Show HN: My SSH server knows who you are

#31

Post by icebraining »

ambrop7 wrote: post #26

Does the server get the client's public key before or after the client has identified the server? I suspect it's after - which would imply that this is much less harmful than it looks like, since by then you've already confirmed the identity of the server. So if my assumption is correct (some quick googling for images of the ssh key exchange suggests it is), then the reason it "works" in this case is because people i…

The server only gets the key after it has been identified; you can see that by using "ssh -v".

Re: Show HN: My SSH server knows who you are

#32

Post by _wmd »

Didn't work for me, not because I don't have a Github key, but because I use separate keys for everything, and don't have a default key (requires plenty of ~/.ssh/config muckery).

I had been doing this because I'm paranoid, and because I have a tendency to copy keys for my colo boxes to work computers, and my Git keys to the colo boxes. Now I have a new reason -- public keys basically act like a giant supercookie for SSH.

Re: Show HN: My SSH server knows who you are

#33

Post by delinka »

pdq wrote: post #28

Found me; very nice. I wouldn't have guessed how you did it without the explanation about GitHub. I wonder if this means we should be rotating keys periodically? I know most companies require users to rotate their password every X days. Also, does GitHub have a setting to disable public key publishing?

You should be using different key pairs on each client machine you log into. You should also be using different key pairs for each host to which you connect (and using ~/.ssh/config to specify which keys are sent to which hosts.)

Not only will this limit correlation as demonstrated here, but also make it much easier to revoke access via keys that may have been compromised.

Re: Show HN: My SSH server knows who you are

#34

Post by joeblau »

acomjean wrote: post #14

Didn't work for me. Here's what I got. I cleaned out .ssh/knownhosts after connecting. +---------------------------------------------------------------------+ | | | _o/ Hello! | | | | | | Did you know that ssh sends all your public keys to any server | | it tries to authenticate to? You can see yours echoed below. | | | | We tried to use that to find your GitHub username, but we | | couldn't :( maybe you don't even h…

Didn't work for me either. It seems like it fails more than it succeeds based on the results posted in this thread.

Re: Show HN: My SSH server knows who you are

#35

Post by kazinator »

scosman wrote: post #5

"don't worry, I don't have any OpenSSH 0day" > That's exactly what someone with a 0 day would say!

Someone with an OpenSSH client 0day would just quietly open an SSH port and wait about five minutes for the next sucker.

You don't have to phish on HN to get people to connect to an SSH port.

Re: Show HN: My SSH server knows who you are

#36

Post by shmerl »

yesco wrote: post #8

Forgive me ignorance here but what steps should I take to avoid someone from getting my public key off github and then using it to screw with my repos? Was there a major step I missed here when I made these keys?

To make it easier. Your public key is something others would place on their servers to grant you access, and you'll need to have your private key to authenticate.

Re: Show HN: My SSH server knows who you are

#37

Post by latortuga »

pdq wrote: post #28

Found me; very nice. I wouldn't have guessed how you did it without the explanation about GitHub. I wonder if this means we should be rotating keys periodically? I know most companies require users to rotate their password every X days. Also, does GitHub have a setting to disable public key publishing?

They're public keys, they're intended to be public. What are you trying to hide by hiding your public key?

Re: Show HN: My SSH server knows who you are

#38

Post by delinka »

samps wrote: post #21

In all seriousity, I would love a similar SSH server that automatically uses keys from GitHub for authentication. Great for setting up a little private git server without fiddling with keys.

Just keep in mind that you're now at the mercy of github. Or whomever pwns their servers.

Re: Show HN: My SSH server knows who you are

#39

Post by bmelton »

acomjean wrote: post #14

Didn't work for me. Here's what I got. I cleaned out .ssh/knownhosts after connecting. +---------------------------------------------------------------------+ | | | _o/ Hello! | | | | | | Did you know that ssh sends all your public keys to any server | | it tries to authenticate to? You can see yours echoed below. | | | | We tried to use that to find your GitHub username, but we | | couldn't :( maybe you don't even h…

It's probably most apt to working when the local username is the same as the username in your SSH keys.

If your local username is something like "johndoe", while your server logins (and keys mapping to them) is "jdoe", it isn't likely to align the one to the other.

If your local and remote usernames tend to be the same, and they are also the same as your Github keys, then it's probably pretty likely to be accurate.

Re: Show HN: My SSH server knows who you are

#40

Post by riffraff »

joeblau wrote: post #34
acomjean wrote: post #14

Didn't work for me. Here's what I got. I cleaned out .ssh/knownhosts after connecting. +---------------------------------------------------------------------+ | | | _o/ Hello! | | | | | | Did you know that ssh sends all your public keys to any server | | it tries to authenticate to? You can see yours echoed below. | | | | We tried to use that to find your GitHub username, but we | | couldn't :( maybe you don't even h…

Didn't work for me either. It seems like it fails more than it succeeds based on the results posted in this thread.

presumably, those for which it worked are less likely to post? FWIW, it worked for me.
Post reply on HN