The connection gets closed immediately for me, what is it supposed to do?
ssh: Connection to root@whoami.filippo.io:22 exited: Remote closed the connection
That's what happens to me from OpenWrt
Show HN: My SSH server knows who you are
81–90 of 257 posts
Re: Show HN: My SSH server knows who you are
#82Nice idea, but don't run the command if you have Host * ForwardAgent yes On your ~/.ssh/config
Don't use agent forwarding to any host you don't have exclusive root access to and are 100% sure isn't compromised. Anyone else who is root on a box you SSH to with agent forwarding can authenticate to other servers using your private key while you are connected.
Re: Show HN: My SSH server knows who you are
#83It just closes my connection.
root@paragonie:~# ssh whoami.filippo.io
Connection to whoami.filippo.io closed.
Re: Show HN: My SSH server knows who you are
#84Neat. I wonder how many "attackers" that scan ssh etc. could be identified by this.
There are probably some morons out there, but I'd be surprised if most automated ssh scanners were offering up a private/public keypair.
The best moron I ever saw had his full name as computer name and we gave him a phone call at his house - his mother answered first, it was awesome!
Re: Show HN: My SSH server knows who you are
#85Found me; very nice. I wouldn't have guessed how you did it without the explanation about GitHub. I wonder if this means we should be rotating keys periodically? I know most companies require users to rotate their password every X days. Also, does GitHub have a setting to disable public key publishing?
They're public keys, they're intended to be public. What are you trying to hide by hiding your public key?
As much as the keys contain public data, I wouldn't consider (but it apparently is) the list of keys with access to my github account public data. Github willingly reveals information about pseudonyms, etc.
This is a data vs metadata thing, the data is public, but who it belongs to, and what one can do with it need not be.
Re: Show HN: My SSH server knows who you are
#86weird idea: server that hosts open source git repos, but won't let you ssh in to clone unless your GitHub account has contributed to an open source project this year.
Until someone forks it
Re: Show HN: My SSH server knows who you are
#87It just closes my connection. root@paragonie:~# ssh whoami.filippo.io Connection to whoami.filippo.io closed. I'm not sure what I'm supposed to be seeing.
...presumably it doesn't allow root logins via SSH
Re: Show HN: My SSH server knows who you are
#88Earlier quoted context omitted.
Forwarding your keys basically. It's like giving someone you don't know a handshake AND all your keys.
public keys I hope?!
I worded it the wrong way I guess.
Edit: I don't really know how do say this short and concise, but you should only do this with servers you trust.
* http://rabexc.org/posts/pitfalls-of-ssh-agents
* http://heipei.github.io/2015/02/26/SSH-Agent-Forwarding-cons...
Re: Show HN: My SSH server knows who you are
#89That's actually super handy. Next time I have to add someone to a shell account, I'll probably just look them up on GitHub first to find their public key instead of asking.
Re: Show HN: My SSH server knows who you are
#90Earlier quoted context omitted.
Exactly! Once I get the keys I just check them against a scraped database of GitHub keys and ask the API for your name. (And if you have agent forwarding active I show you a big WARNING [0].) There's an explanation in the README [1] but the actually interesting stuff is in server.go [2]. Finally I mentioned a few reasons it might not work for you below [3]. [0] http://git.io/vOVYm [1] https://github.com/FiloSottile/w…
It's a cool awareness experiment. Ultimately, public keys are public and people shouldn't be afraid of sharing them. Agent forwarding sharing is a big one though. Getting people to stop doing that automatically takes a lot of education. https://wiki.mozilla.org/Security/Guidelines/OpenSSH#SSH_age...
The public keys should be ok. But the comment on them may be a problem.