21–30 of 123 posts
> Host B
> ProxyCommand ssh -W B:22 A
> Host B
> ProxyCommand ssh -W %h:%p A
The article didn't make mention multiplexing and MaxSessions defaults in OpenSSH. The default is 10 which means you auth once, and all subsequent logins are without auth and without syslog entries. If you manage secure systems and have 2FA, this allows bypassing 2FA and logging. All I have to do is trick your folks into testing a ruby / python / perl / bash script for me that will drop a key on your machine, fire up…
so... your point is "don't run untrusted code"?
Arguably, plain HTML is also untrusted code, and I certainly don't trust every single one of the authors of my operating system and all of the os-level utilities and all the applications that I use, especially not Microsoft or Apple. But I'm forced to use them for work.
A year or two ago there was some hoopla about Canonical collecting some information about Ubuntu's users or something like that (don't remember exactly) and a lot of people were up in arms about how they don't trust Canonical. Canonical's reply was one of the most insightful I've ever read on the internet. They said something like, "um... but we've got root".
That's a great point. The makers of your OS, the builders of your apps, they have a lot of power over you that you grant them simply by using their stuff. You're effectively trusting them, even if you don't trust them.
You could react by not using anything that anyone you don't trust writes, or by thoroughly auditing all the source code of everything you use (you do use only open-source software which can be audited by you directly, right?). But this is not really practical for 99% of everyone on the planet.
This doesn't make sense. You can safely setup SSH agent forwarding to ssh from server to server without storing your ssh private key anywhere but your local host.
I thought using per-service SSH keys was an useful mitigation against e.g. GitHub public keys being exposed: - https://blog.benjojo.co.uk/post/auditing-github-users-keys - http://arstechnica.com/security/2015/06/assume-your-github-a... - https://news.ycombinator.com/item?id=9645703
Public keys being exposed isn't something I think needs to be mitigated. That's the whole point, they're public.
SSH's new AuthenticationMethods directive is extremely useful for pairing SSH keys with a password and/or 2FA. You should absolutely use keys everywhere, and encourage your users to encrypt their keys, but enforcing a password as well ensures that logins are "something you have" (the SSH key) and "something you know" (the password) as a sort of 2FA. As a cherry on top you can put the password in LDAP or RADIUS server…
Something you have plus 2 things you know does not turn 2FA into 3FA. It's still 2FA - it's just somethings you know instead of something you know. 3 FA is : * Something you have (normally one OR MORE user IDs) * Something you know (normally the associated password or passwords for the user ID(s)) * Something you are (normally biometric) [edit: technically, it's multi-factor when using multiple user/passwords - here'…
You have your fingers. You have your eyes.
In fiction and movies, these things that you have which could be taken from you (your fingers severed, your eyes plucked out) and used for getting past biometric scanners.
In real life there are easier, stealthier, and less gruesome methods for getting those things: just copy them. (gummy bear fingerprints, anyone? [1][2][3])
[1] - http://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_f...
[2] - http://www.cryptome.org/gummy.htm
[3] - http://www.it.slashdot.org/story/10/10/28/0124242/aussie-kid...
>Do not SSH cross-server This doesn't make sense. You can safely setup SSH agent forwarding to ssh from server to server without storing your ssh private key anywhere but your local host.
Earlier quoted context omitted.
so... your point is "don't run untrusted code"?
You run untrusted code whenever your browser loads a web page that uses javascript. With more and more of the web requiring javascript to work, running untrusted code becomes less and less a real option if you want to get any work done. Arguably, plain HTML is also untrusted code, and I certainly don't trust every single one of the authors of my operating system and all of the os-level utilities and all the applicati…
Which is incredibly misleading.
Sure, they could put malicious code in their distribution. It could do whatever they want. And then it would be on your machine, where you can potentially discover it and publish what you've discovered and allow others to verify your discovery. Which could cause Canonical to not have root anymore, because people would immediately switch to Debian or CentOS or something else.
But if they send data from your machine to their servers, no one has any ability to determine what they do with it from there, how well they secure it, who they give or sell it to, etc. It's a completely different situation because it goes from trust-but-verify to blind trust.