Show HN: My SSH server knows who you are • Hacker News Board

Re: Show HN: My SSH server knows who you are

#151

Post by noobermin » Tue, Aug 04, 2015, 10:46 PM UTC

FiloSottile wrote: post #43

acomjean wrote: post #14

Didn't work for me. Here's what I got. I cleaned out .ssh/knownhosts after connecting. +---------------------------------------------------------------------+ | | | _o/ Hello! | | | | | | Did you know that ssh sends all your public keys to any server | | it tries to authenticate to? You can see yours echoed below. | | | | We tried to use that to find your GitHub username, but we | | couldn't :( maybe you don't even h…

Hi! A few reasons it might fail: * You don't have your SSH keys on GitHub * You don't have your GitHub keys on that laptop * Your key is not RSA (because I'm LAZY) * Your ssh version uses only recent algorithms not supported by Go's x/crypto/ssh * You actually disabled IdentityKeys Nothing to do with usernames or heuristics, by the way. All it does is first enumerate your client keys, then let you in, then check a hu…

Whenever I push, I login. Apparently this laziness saved my ass this time. Of course, this could be used on any service I ssh into regularly and has a scrappable listing of users, so it's good of you to bring this up.

Re: Show HN: My SSH server knows who you are

#152

Post by GauntletWizard » Tue, Aug 04, 2015, 10:54 PM UTC

The last time this came up, I wrote a little script to update your authorized_keys file with your github keys.

https://github.com/GauntletWizard/pamgithub

Re: Show HN: My SSH server knows who you are

#153

Post by craigds » Tue, Aug 04, 2015, 10:59 PM UTC

dmytrish wrote: post #111

At first, I thought that this is pretty harmless, but now I suspect that there may be a way to exploit a dump of public keys tied to personal information: let's say that some powerful adversary (like NSA) uses some kind of rainbow tables to associate public keys with private. Having a lot of public keys, they are likely to know some private ones and identities behind them. This hypothesis requires some mathematical g…

Not exactly a cryptography guy, but I don't think PKC quite works like that.

Rainbow tables rely on people using the same password as each other. This happens a lot with passwords, but it's unlikely to happen with key pairs, assuming they're generated with proper CSPRNGs.

Re: Show HN: My SSH server knows who you are

#154

Post by taejo » Tue, Aug 04, 2015, 11:00 PM UTC

bmelton wrote: post #39

acomjean wrote: post #14

Didn't work for me. Here's what I got. I cleaned out .ssh/knownhosts after connecting. +---------------------------------------------------------------------+ | | | _o/ Hello! | | | | | | Did you know that ssh sends all your public keys to any server | | it tries to authenticate to? You can see yours echoed below. | | | | We tried to use that to find your GitHub username, but we | | couldn't :( maybe you don't even h…

It's probably most apt to working when the local username is the same as the username in your SSH keys. If your local username is something like "johndoe", while your server logins (and keys mapping to them) is "jdoe", it isn't likely to align the one to the other. If your local and remote usernames tend to be the same, and they are also the same as your Github keys, then it's probably pretty likely to be accurate.

It's based exclusively on the public key. My local username and github login are unrelated, and it worked for me.

Re: Show HN: My SSH server knows who you are

#155

Post by petrsnd » Tue, Aug 04, 2015, 11:03 PM UTC

There may be some people concerned with GitHub publishing their identity to everyone, but it is pretty easy to use a separate key for GitHub (they'll even generate it for you) if you configure your ssh client appropriately with Host sections. Also, the same technique works if you want to use two different accounts on GitHub (one for work & one for personal). http://stackoverflow.com/questions/19310368/using-two-ssh-ke...

Re: Show HN: My SSH server knows who you are

#156

Post by JoshTriplett » Tue, Aug 04, 2015, 11:04 PM UTC

scintill76 wrote: post #149

JoshTriplett wrote: post #70

Earlier quoted context omitted.

> (And if you have agent forwarding active I show you a big WARNING [0].) It amazes me that people enable that for random servers. Seems like SSH should make that harder. Enabling it for a specific server you trust makes sense; enabling it for all servers doesn't. SSH could reject "ForwardAgent" outside a Host block, for instance, and force you to at least write a "Host *" block. EDIT: Check out this search: https://…

I also use the -c (confirm) flag with ssh-add. I don't forward the agent willy-nilly, but if someone still manages to compromise the agent, I will hopefully know when I'm getting confirmation popups I didn't initiate.

I wish gnome-keyring's integrated ssh agent supported that.

Re: Show HN: My SSH server knows who you are

#157

Post by jrockway » Tue, Aug 04, 2015, 11:06 PM UTC

arturhoo wrote: post #56

Nice idea, but don't run the command if you have Host * ForwardAgent yes On your ~/.ssh/config

Is this a problem if my private key is on a smartcard and I have to press a button on the card to sign something?

Re: Show HN: My SSH server knows who you are

#158

Post by ernsheong » Tue, Aug 04, 2015, 11:06 PM UTC

"Public keys" are supposed to be public anyway, isn't that what it's designed for? I see no harm

Re: Show HN: My SSH server knows who you are

#159

Post by blfr » Tue, Aug 04, 2015, 11:10 PM UTC

FiloSottile wrote: post #140

chrisfosterelli wrote: post #30

FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.…

Double-reading the man page I noticed that IdentitiesOnly makes ssh only send IdentityFile keys, however IdentityFile has a default of "~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519 and ~/.ssh/id_rsa". The result is that with this configuration you would still send id_rsa to unknown hosts. You also need to add "PubkeyAuthentication no" to your global stanza, and re-enable it for good hosts. # Ignore ssh-agent key…

You also need to add "PubkeyAuthentication no" to your global stanza, and re-enable it for good hosts.

Or rename the id_* keys to something else. If you're using multiple key pairs will want more descriptive names anyway.

Re: Show HN: My SSH server knows who you are

#160

Post by userbinator » Tue, Aug 04, 2015, 11:18 PM UTC

ernsheong wrote: post #158

"Public keys" are supposed to be public anyway, isn't that what it's designed for? I see no harm

Using the same public key on two sites is like using the same username - something that you would do only if you want your identity linked between those sites. It's also a much stronger proof of identity than having the same username, because that's what they were designed for.