Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: My SSH server knows who you are

blog.filippo.io

Post reply on HN
Print view View original

61–70 of 257 posts

Re: Show HN: My SSH server knows who you are

#61

Post by rmetzler »

songgao wrote: post #58
FiloSottile wrote: post #57

Earlier quoted context omitted.

Exactly! Once I get the keys I just check them against a scraped database of GitHub keys and ask the API for your name. (And if you have agent forwarding active I show you a big WARNING [0].) There's an explanation in the README [1] but the actually interesting stuff is in server.go [2]. Finally I mentioned a few reasons it might not work for you below [3]. [0] http://git.io/vOVYm [1] https://github.com/FiloSottile/w…

This might be more obvious than I thought, but could you explain how you scraped all of GitHub keys throughout the entire user-base?

There is a URL for the keys of a user. And phillipo used the dataset benjojo published a few month ago when he scraped all the keys: https://blog.benjojo.co.uk/post/auditing-github-users-keys

Re: Show HN: My SSH server knows who you are

#63

Post by rmetzler »

FiloSottile wrote: post #43
acomjean wrote: post #14

Didn't work for me. Here's what I got. I cleaned out .ssh/knownhosts after connecting. +---------------------------------------------------------------------+ | | | _o/ Hello! | | | | | | Did you know that ssh sends all your public keys to any server | | it tries to authenticate to? You can see yours echoed below. | | | | We tried to use that to find your GitHub username, but we | | couldn't :( maybe you don't even h…

Hi! A few reasons it might fail: * You don't have your SSH keys on GitHub * You don't have your GitHub keys on that laptop * Your key is not RSA (because I'm LAZY) * Your ssh version uses only recent algorithms not supported by Go's x/crypto/ssh * You actually disabled IdentityKeys Nothing to do with usernames or heuristics, by the way. All it does is first enumerate your client keys, then let you in, then check a hu…

- The key might be to new for the dataset.

Re: Show HN: My SSH server knows who you are

#64

Post by rmetzler »

chmike wrote: post #60
arturhoo wrote: post #56

Nice idea, but don't run the command if you have Host * ForwardAgent yes On your ~/.ssh/config

What is the effect of ForwardAgent ?

Forwarding your keys basically. It's like giving someone you don't know a handshake AND all your keys.

Re: Show HN: My SSH server knows who you are

#65

Post by golergka »

omarforgotpwd wrote: post #62

weird idea: server that hosts open source git repos, but won't let you ssh in to clone unless your GitHub account has contributed to an open source project this year.

This would make this repos not open source, unless they are replicated elsewhere as well.

Re: Show HN: My SSH server knows who you are

#66

Post by ars »

chrisfosterelli wrote: post #30

FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.…

Is there a way to set that in bulk so all hosts in your config send identities, but those not specified don't, without putting IdentityFile for every one?

Re: Show HN: My SSH server knows who you are

#67

Post by gmalette »

mhurron wrote: post #52
tacone wrote: post #7

> Did you know that ssh sends all your public keys to any server it tries to authenticate to? You can see yours echoed below. > We tried to use that to find your GitHub username, but we couldn't :( maybe you don't even have GitHub ssh keys, do you? > By the way, did you know that GitHub publishes all users' ssh public keys and Ben (benjojo.co.uk) grabbed them all? > That's pretty handy at times :) But not this time :…

> By the way, did you know that GitHub publishes all users' ssh public keys and Ben (benjojo.co.uk) grabbed them all? > That's pretty handy at times :) But not this time :( >Better luck next time, I guess :) Who cares if they publish Public Keys. They're meant to be public, it's one of the few well named things in computer science. They are basically meant to be spewn everywhere.

You may be interested in knowing that you can DOS someone if you know only their public keys. https://medium.com/@gmalette/mistaking-authentication-for-id...

Re: Show HN: My SSH server knows who you are

#68

Post by gmalette »

justizin wrote: post #53
latortuga wrote: post #37

Earlier quoted context omitted.

They're public keys, they're intended to be public. What are you trying to hide by hiding your public key?

Though it may be incredibly impractical or theoretically impossible, depending on the key and time of day, there is always a possibility that a public key can be used as an attack vector to guess a private key.

Or simply to DOS you out of your other accounts. https://news.ycombinator.com/item?id=10005358

Re: Show HN: My SSH server knows who you are

#69

Post by brandonwamboldt »

arturhoo wrote: post #56

Nice idea, but don't run the command if you have Host * ForwardAgent yes On your ~/.ssh/config

Yes, for more information, see SSH Agent Forwarding Considered Harmful (http://heipei.github.io/2015/02/26/SSH-Agent-Forwarding-cons...). Finally a legitimate use of the title "considered harmful".

Re: Show HN: My SSH server knows who you are

#70

Post by JoshTriplett »

FiloSottile wrote: post #57
chrisfosterelli wrote: post #30

FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.…

Exactly! Once I get the keys I just check them against a scraped database of GitHub keys and ask the API for your name. (And if you have agent forwarding active I show you a big WARNING [0].) There's an explanation in the README [1] but the actually interesting stuff is in server.go [2]. Finally I mentioned a few reasons it might not work for you below [3]. [0] http://git.io/vOVYm [1] https://github.com/FiloSottile/w…

> (And if you have agent forwarding active I show you a big WARNING [0].)

It amazes me that people enable that for random servers. Seems like SSH should make that harder. Enabling it for a specific server you trust makes sense; enabling it for all servers doesn't. SSH could reject "ForwardAgent" outside a Host block, for instance, and force you to at least write a "Host *" block.

EDIT: Check out this search: https://github.com/search?utf8=%E2%9C%93&q=ForwardAgent&type...

Post reply on HN