I wish there was a way to have ssh automatically ssh-add keys you use... with a expiration date. I've tried to get this to work a few times, but I use a unique key for every login, so I need something to parse ~/.ssh/config to find the right Host def and ssh-add it. The code is obviously in ssh, but it's not exposed to the command line as far as I can tell.
Show HN: My SSH server knows who you are
221–230 of 257 posts
Re: Show HN: My SSH server knows who you are
#222So… the fact ssh leaks some information you find more worrying then people storing their source code at github? interesting...
Re: Show HN: My SSH server knows who you are
#223No sure if I am missing something here, but that's the idea behind PKI infrastructure: You can share your public keys without putting your identity at risk.
The "server knows who you are" or rather, I "tell the server who I am"
Interesting experiment though.
Re: Show HN: My SSH server knows who you are
#224Earlier quoted context omitted.
The remote ssh process asks your host to unencrypt it's traffic? Your process takes an encrypted stream, sends the plaintext, and your keys never leave your machine. That's...incredibly clever, although I can only think of one scenario where it would be necessary (navigating securely through a sequence of ssh sessions where some of the secondary hosts are inaccessible from your originating host. E.g. a kind of "secur…
its very useful for so called "Bastion Hosts", an SSH server that allows further access into the network and is totally locked down.
You don't need agent forwarding for that. Just use ssh's dumb tcp forwarding and keep your agent on your local host.
Ex.:
Host bastion.company
ProxyCommand none
Host *.company
ProxyCommand ssh -W %h:%p bastion.companyRe: Show HN: My SSH server knows who you are
#225Eh, I only forward my github ssh key to the host github.com so you don't know who I am ;-)
Re: Show HN: My SSH server knows who you are
#226Earlier quoted context omitted.
Exactly! Once I get the keys I just check them against a scraped database of GitHub keys and ask the API for your name. (And if you have agent forwarding active I show you a big WARNING [0].) There's an explanation in the README [1] but the actually interesting stuff is in server.go [2]. Finally I mentioned a few reasons it might not work for you below [3]. [0] http://git.io/vOVYm [1] https://github.com/FiloSottile/w…
> (And if you have agent forwarding active I show you a big WARNING [0].) It amazes me that people enable that for random servers. Seems like SSH should make that harder. Enabling it for a specific server you trust makes sense; enabling it for all servers doesn't. SSH could reject "ForwardAgent" outside a Host block, for instance, and force you to at least write a "Host *" block. EDIT: Check out this search: https://…
Thanks for the tip. I use ForwardAgent for all my servers at work, but I had it defined in a "Host *" block. I've now setup separate blocks for my work domains and have moved ForwardAgent into there alone. Never knew it was a risk until this thread.
Re: Show HN: My SSH server knows who you are
#227I dont want to "play" with ssh_config file. My concern here is how pageant/ssh-agent behave, i think i'll try to fix/find a way around that (e.g. attended calls to agent signing api / configurable calls to agent keys listing).
I think i'll drive a node-webkit/systray project being an alternative to pageant (#nwagent on freenode)
Re: Show HN: My SSH server knows who you are
#228A good reminder that your public keys are, in fact, public. For most people, this is probably a good thing, unless you're specifically trying to hide your identity.
But I wish anonymity was the default, not something I have to enable as a special case... :(
Re: Show HN: My SSH server knows who you are
#229Earlier quoted context omitted.
public keys I hope?!
No, it gives the remote server use of your private keys during the lifetime of your connection through connection to your local agent. Yes, it's really stupid to enable AgentForwarding.
OMG! This was an important and helpful precision. Thank you very much.
Re: Show HN: My SSH server knows who you are
#230FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.…
Exactly! Once I get the keys I just check them against a scraped database of GitHub keys and ask the API for your name. (And if you have agent forwarding active I show you a big WARNING [0].) There's an explanation in the README [1] but the actually interesting stuff is in server.go [2]. Finally I mentioned a few reasons it might not work for you below [3]. [0] http://git.io/vOVYm [1] https://github.com/FiloSottile/w…
Thanks for the warning by the way! Moved forwardagent to specific servers.
I almost always log into trusted servers, but it's good to be preemptive ;-)