Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: My SSH server knows who you are

blog.filippo.io

Post reply on HN
Print view View original

131–140 of 257 posts

Re: Show HN: My SSH server knows who you are

#131

Post by rogeryu »

chrisfosterelli wrote: post #30

FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.…

> If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does)

If you have five keys, and the second is the one that's needed, doesn't that mean that only the first two keys are sent?

Anyway, this is very good to know, and I'm going to take action to make this more secure.

Re: Show HN: My SSH server knows who you are

#132

Post by mahouse »

woof wrote: post #109
mahouse wrote: post #81

Earlier quoted context omitted.

ssh: Connection to root@whoami.filippo.io:22 exited: Remote closed the connection That's what happens to me from OpenWrt

Go figure, root.

root because that's the user I use to log into OpenWrt. But it's the same if I change it.

Re: Show HN: My SSH server knows who you are

#133

Post by morganvachon »

NotHereNotThere wrote: post #122
morganvachon wrote: post #29

Earlier quoted context omitted.

Strictly speaking, it didn't fail; PuTTY on Windows works a bit differently from command-line ssh on OS X/Linux, and doesn't show you everything. It brings you directly to a "login as:" prompt after throwing up a dialog about missing/unknown keys. What you were supposed to see never made it to the screen.

Worked fine on my PuTTY, got the message after leaving an empty user at the "login as:" prompt

Interesting. When I tried it at work earlier (Windows 7, latest PuTTY) it closed out the window without showing anything. I just tried it at home (Windows 10, latest PuTTY) and it worked as you said.

Re: Show HN: My SSH server knows who you are

#136

Post by saurik »

javajosh wrote: post #130
phamilton wrote: post #115

Earlier quoted context omitted.

For those who don't get why this is terrible, imagine if GitHub were compromised and their ssh agent tampered with. When you clone a repo, they could use your forwarded agent to log into your production hosts. That's pretty bad.

I don't fully understand how this would work - the key being "forwarded agent". My (poor) understanding is that in order for compromised github to get to a host I'm connected to they would somehow need to invoke ssh on my host, somehow. The only way that would not be the case is if ssh maintains an in-memory persistent thing that a) maintains connections to foreign hosts, and b) can somehow be signaled from active co…

Well, what you describe (pretty much) is the "agent", and many people do, in fact, find it "quite handy" ;P. (I do not use this feature, myself.)

Re: Show HN: My SSH server knows who you are

#137

Post by [deleted] »

javajosh wrote: post #130
phamilton wrote: post #115

Earlier quoted context omitted.

For those who don't get why this is terrible, imagine if GitHub were compromised and their ssh agent tampered with. When you clone a repo, they could use your forwarded agent to log into your production hosts. That's pretty bad.

I don't fully understand how this would work - the key being "forwarded agent". My (poor) understanding is that in order for compromised github to get to a host I'm connected to they would somehow need to invoke ssh on my host, somehow. The only way that would not be the case is if ssh maintains an in-memory persistent thing that a) maintains connections to foreign hosts, and b) can somehow be signaled from active co…

[deleted]

Re: Show HN: My SSH server knows who you are

#139

Post by chrisfosterelli »

rogeryu wrote: post #131
chrisfosterelli wrote: post #30

FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.…

> If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you have five keys, and the second is the one that's needed, doesn't that mean that only the first two keys are sent? Anyway, this is very good to know, and I'm going to take action to make this more secure.

Yes, provided that the server accepted the second key the rest would not be sent. However, the server can simply respond that each key is incorrect (regardless of if it is or not), and then get all five keys.

Once SSH has ran out of keys to try, it tries to move on to other authentication methods. The go app he has written then automatically accepts the connection at that point, once it knows it has seen all of your keys.

Re: Show HN: My SSH server knows who you are

#140

Post by FiloSottile »

chrisfosterelli wrote: post #30

FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.…

Double-reading the man page I noticed that IdentitiesOnly makes ssh only send IdentityFile keys, however IdentityFile has a default of "~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519 and ~/.ssh/id_rsa".

The result is that with this configuration you would still send id_rsa to unknown hosts.

You also need to add "PubkeyAuthentication no" to your global stanza, and re-enable it for good hosts.

    # Ignore ssh-agent keys
    IdentitiesOnly yes
    # Disable public key authentication
    PubkeyAuthentication no

    # Send your public key to github only
    Host github.com
        PubkeyAuthentication yes
        IdentityFile ~/.ssh/id_rsa
More instructions: https://github.com/FiloSottile/whosthere#how-do-i-stop-it
Post reply on HN