51–60 of 257 posts
Neat stuff. You could use this to let users identify themselves to services/ssh services via pubkey as their GitHub username - like https://github.com/shazow/ssh-chat - but with users automatically unique and identified by GitHub.
> Did you know that ssh sends all your public keys to any server it tries to authenticate to? You can see yours echoed below. > We tried to use that to find your GitHub username, but we couldn't :( maybe you don't even have GitHub ssh keys, do you? > By the way, did you know that GitHub publishes all users' ssh public keys and Ben (benjojo.co.uk) grabbed them all? > That's pretty handy at times :) But not this time :…
>Better luck next time, I guess :)
Who cares if they publish Public Keys. They're meant to be public, it's one of the few well named things in computer science. They are basically meant to be spewn everywhere.
Found me; very nice. I wouldn't have guessed how you did it without the explanation about GitHub. I wonder if this means we should be rotating keys periodically? I know most companies require users to rotate their password every X days. Also, does GitHub have a setting to disable public key publishing?
They're public keys, they're intended to be public. What are you trying to hide by hiding your public key?
Good thing I use HTTP to push to Github (or not?)
Didn't work for me, not because I don't have a Github key, but because I use separate keys for everything, and don't have a default key (requires plenty of ~/.ssh/config muckery). I had been doing this because I'm paranoid, and because I have a tendency to copy keys for my colo boxes to work computers, and my Git keys to the colo boxes. Now I have a new reason -- public keys basically act like a giant supercookie for…
Host github.com
User toxicFork
IdentityFile ~/.ssh/github-toxicFork
Host bitbucket.org
User toxicFork
IdentityFile ~/.ssh/bitbucket-toxicFork
- Once I want to use a device for development, I create separate key pairs for all of the services I want to use, register it on that server's account config and then add it to my config file by hand ( I should find or write a script to do these automatically :D )
- Once I want to retire a device (or if it gets lost) I just remove the public keys from the services
- NEVER move or copy private keys, I'd rather create a new private key and remove the references for the old public keys instead
Host *
ForwardAgent yes
FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.…
(And if you have agent forwarding active I show you a big WARNING [0].)
There's an explanation in the README [1] but the actually interesting stuff is in server.go [2]. Finally I mentioned a few reasons it might not work for you below [3].
[1] https://github.com/FiloSottile/whosthere
[2] https://github.com/FiloSottile/whosthere/blob/master/src/ssh...
FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.…
Exactly! Once I get the keys I just check them against a scraped database of GitHub keys and ask the API for your name. (And if you have agent forwarding active I show you a big WARNING [0].) There's an explanation in the README [1] but the actually interesting stuff is in server.go [2]. Finally I mentioned a few reasons it might not work for you below [3]. [0] http://git.io/vOVYm [1] https://github.com/FiloSottile/w…
FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.…
Exactly! Once I get the keys I just check them against a scraped database of GitHub keys and ask the API for your name. (And if you have agent forwarding active I show you a big WARNING [0].) There's an explanation in the README [1] but the actually interesting stuff is in server.go [2]. Finally I mentioned a few reasons it might not work for you below [3]. [0] http://git.io/vOVYm [1] https://github.com/FiloSottile/w…
Agent forwarding sharing is a big one though. Getting people to stop doing that automatically takes a lot of education. https://wiki.mozilla.org/Security/Guidelines/OpenSSH#SSH_age...
Nice idea, but don't run the command if you have Host * ForwardAgent yes On your ~/.ssh/config