Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: My SSH server knows who you are

blog.filippo.io

Post reply on HN
Print view View original

201–210 of 257 posts

Re: Show HN: My SSH server knows who you are

#201

Post by riffraff »

skarap wrote: post #104
JoshTriplett wrote: post #70

Earlier quoted context omitted.

> (And if you have agent forwarding active I show you a big WARNING [0].) It amazes me that people enable that for random servers. Seems like SSH should make that harder. Enabling it for a specific server you trust makes sense; enabling it for all servers doesn't. SSH could reject "ForwardAgent" outside a Host block, for instance, and force you to at least write a "Host *" block. EDIT: Check out this search: https://…

> EDIT: Check out this search: https://github.com/search?utf8=%E2%9C%93&q=ForwardAgent&type... . Holy mother of god, can we somehow return to the time when almost nobody used *nix and Microsoft was the one struggling to keep systems of these people secure?

I don't think this time ever existed, I remember some fifteen years ago using google to search for unshadowed /etc/passwd and vulnerable cgi scripts, and there were tons of results.

Re: Show HN: My SSH server knows who you are

#202

Post by reidrac »

acomjean wrote: post #14

Didn't work for me. Here's what I got. I cleaned out .ssh/knownhosts after connecting. +---------------------------------------------------------------------+ | | | _o/ Hello! | | | | | | Did you know that ssh sends all your public keys to any server | | it tries to authenticate to? You can see yours echoed below. | | | | We tried to use that to find your GitHub username, but we | | couldn't :( maybe you don't even h…

Just run "ssh-keygen -R whoami.filippo.io".

Re: Show HN: My SSH server knows who you are

#203

Post by senthilnayagam »

like google analytics cookies track your every activity on every website, sending public keys feel the same way.

now I have to re-evaluate my ssh usage after discovering ssh sends all my public keys. need to setup per server identities, without too much usage hassle .

hope github will stop publishing public keys.

Re: Show HN: My SSH server knows who you are

#204

Post by javajosh »

JoshTriplett wrote: post #143
javajosh wrote: post #130

Earlier quoted context omitted.

I don't fully understand how this would work - the key being "forwarded agent". My (poor) understanding is that in order for compromised github to get to a host I'm connected to they would somehow need to invoke ssh on my host, somehow. The only way that would not be the case is if ssh maintains an in-memory persistent thing that a) maintains connections to foreign hosts, and b) can somehow be signaled from active co…

The SSH agent maintains your private keys and provides the necessary responses to ssh when it wants to authenticate to a server. If you ssh to a server and forward your SSH agent, that server can then run ssh themselves and impersonate you to a different remote server, and your SSH agent will supply the necessary authentication information. Or, in short: never use ForwardAgent (or ssh -A) to a server you don't trust.

The remote ssh process asks your host to unencrypt it's traffic? Your process takes an encrypted stream, sends the plaintext, and your keys never leave your machine. That's...incredibly clever, although I can only think of one scenario where it would be necessary (navigating securely through a sequence of ssh sessions where some of the secondary hosts are inaccessible from your originating host. E.g. a kind of "secure trojan horse".

Sometimes I feel just so awed at the ingenuity of people, especially with software and computers.

Re: Show HN: My SSH server knows who you are

#205

Post by rdl »

eru wrote: post #196
rdl wrote: post #190

Earlier quoted context omitted.

passphrase is set/unset locally and not communicated to the server if it is present/used/etc. Could be disabled. along with various other things. HW token with ssh key inside is probably the best. The annoying thing is devices w/o USB. For iOS devices and android devices which support it it's probably better to just use the HW sec features. Something which did bt 4.0le and maybe had a single local LED and button woul…

> The annoying thing is devices w/o USB. Some new tokens use NFC.

Yeah, but sadly closed iOS sometimes oddly security hostile ecosystem bullshit.

Bluetooth would be vastly better for interop.

Re: Show HN: My SSH server knows who you are

#206

Post by ersii »

eru wrote: post #181
rdl wrote: post #99

I use different keypairs for different trust domains. (also makes it easier to hand over access when you quit a job.) SSH keys are actually pretty horrible from a security perspective; no expiration, generally held in software, etc. And without a lot of work, single-factor. I love the ssh security model of being pretty good and better than telnet for everything (which it ~fully displaced, unlike https vs. http), but…

> And without a lot of work, single-factor. Wouldn't a passphrase be a second factor? By the way, we use a security fob at work for that. Seems to work fairly well. The private key never leaves the fob, you have to press a button to sign anything, and every once in a while you have to enter your passphrase.

What hardware token (security fob) are you guys using? And is it working well?

Re: Show HN: My SSH server knows who you are

#207

Post by umangd »

brandonbloom wrote: post #188
FiloSottile wrote: post #57

Earlier quoted context omitted.

Exactly! Once I get the keys I just check them against a scraped database of GitHub keys and ask the API for your name. (And if you have agent forwarding active I show you a big WARNING [0].) There's an explanation in the README [1] but the actually interesting stuff is in server.go [2]. Finally I mentioned a few reasons it might not work for you below [3]. [0] http://git.io/vOVYm [1] https://github.com/FiloSottile/w…

And now I've rotated my keys and fixed my ssh config file. Thanks :-)

why rotate them? They're just public keys anyways. Useless on their own.

Re: Show HN: My SSH server knows who you are

#208

Post by throwaway2048 »

javajosh wrote: post #204
JoshTriplett wrote: post #143

Earlier quoted context omitted.

The SSH agent maintains your private keys and provides the necessary responses to ssh when it wants to authenticate to a server. If you ssh to a server and forward your SSH agent, that server can then run ssh themselves and impersonate you to a different remote server, and your SSH agent will supply the necessary authentication information. Or, in short: never use ForwardAgent (or ssh -A) to a server you don't trust.

The remote ssh process asks your host to unencrypt it's traffic? Your process takes an encrypted stream, sends the plaintext, and your keys never leave your machine. That's...incredibly clever, although I can only think of one scenario where it would be necessary (navigating securely through a sequence of ssh sessions where some of the secondary hosts are inaccessible from your originating host. E.g. a kind of "secur…

its very useful for so called "Bastion Hosts", an SSH server that allows further access into the network and is totally locked down.

Re: Show HN: My SSH server knows who you are

#210

Post by emmelaich »

Didn't work for me because I use a separate key for each "class" of machines, where class is github, bitbucket, work, home, ...

You can reduce the maintenance load by using the %h (remote hostname) and %r (remote username) substitutions in IdentityFile. I make a symlink from the key I want to e.g. id-rsa-@.key and use IdentitiesOnly.

See 'man ssh_config'

Use %u (local user) and %l (local hostname) for extra control.

It doesn't have %p (port) but the Host parameter in future versions of openssh will let you match on that too.

Post reply on HN