Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Invite friends to SSH into your laptop using their GitHub handle

gravitational.com

Post reply on HN
Print view View original

71–80 of 105 posts

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#71

Post by uiri »

a3_nm wrote: post #61
aleyan wrote: post #31

Neat. I use the following incantation when authorizing folks to ssh into my servers via github public keys: curl https://github.com/[github name].keys >> ~/.ssh/authorized_keys [github name] here should be replaced with github username of your friend or colleague. Really handy because I can just authorize them without a human request/response loop and manual key moving. Simple and no external tools needed. Normal cav…

Of course, caveats about trusting Github also apply. (If Github got hacked, the page https://github.com/[github name].keys would serve the public key of a fresh attacker-controlled key and would trigger shortly afterwards an SSH login attempt with that key towards the client IP to do evil stuff.)

Not only GitHub but the specific user's account could be compromised through e.g. a weak or reused password.

In the general case, you should be fine. Even more so if the person whose GitHub account you are authorizing regularly checks their keys for suspicious activity.

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#72

Post by andrewguenther »

aleyan wrote: post #31

Neat. I use the following incantation when authorizing folks to ssh into my servers via github public keys: curl https://github.com/[github name].keys >> ~/.ssh/authorized_keys [github name] here should be replaced with github username of your friend or colleague. Really handy because I can just authorize them without a human request/response loop and manual key moving. Simple and no external tools needed. Normal cav…

This is really the correct way to accomplish what this project is trying to do. No central proxy server that you need to trust and can be trivially done with the commands you already have installed.

I would honestly highly recommend against using Teleconsole for those reasons.

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#73

Post by ams6110 »

uiri wrote: post #71
a3_nm wrote: post #61

Earlier quoted context omitted.

Of course, caveats about trusting Github also apply. (If Github got hacked, the page https://github.com/[github name].keys would serve the public key of a fresh attacker-controlled key and would trigger shortly afterwards an SSH login attempt with that key towards the client IP to do evil stuff.)

Not only GitHub but the specific user's account could be compromised through e.g. a weak or reused password. In the general case, you should be fine. Even more so if the person whose GitHub account you are authorizing regularly checks their keys for suspicious activity.

You can (and should) verify the key fingerprint out of band.

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#74

Post by kasbah »

andrewguenther wrote: post #72
aleyan wrote: post #31

Neat. I use the following incantation when authorizing folks to ssh into my servers via github public keys: curl https://github.com/[github name].keys >> ~/.ssh/authorized_keys [github name] here should be replaced with github username of your friend or colleague. Really handy because I can just authorize them without a human request/response loop and manual key moving. Simple and no external tools needed. Normal cav…

This is really the correct way to accomplish what this project is trying to do. No central proxy server that you need to trust and can be trivially done with the commands you already have installed. I would honestly highly recommend against using Teleconsole for those reasons.

Just authorizing ssh login doesn't solve the NAT traversal.

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#76

Post by broknbottle »

geofft wrote: post #43
giblfiz wrote: post #39

how is "curl https://www.teleconsole.com/get.sh | sh " Still considered even a remotely acceptable method for installation?

What's wrong with it? If you're claiming that you don't get the ability to audit the code, I'd like to watch you audit a ./configure shell script generated by GNU autoconf. If you're claiming that you want to apt-get install so the package maintainer has audited the code, I'd like to watch them audit the ./configure shell script. Downloading and auditing code from an untrusted source is security theatre. Don't instal…

if the connection closes mid stream it could potentially run something catastrophic (rm -rf /) as sh will execute the partial command in its buffer.

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#77

Post by old-gregg »

andrewguenther wrote: post #72
aleyan wrote: post #31

Neat. I use the following incantation when authorizing folks to ssh into my servers via github public keys: curl https://github.com/[github name].keys >> ~/.ssh/authorized_keys [github name] here should be replaced with github username of your friend or colleague. Really handy because I can just authorize them without a human request/response loop and manual key moving. Simple and no external tools needed. Normal cav…

This is really the correct way to accomplish what this project is trying to do. No central proxy server that you need to trust and can be trivially done with the commands you already have installed. I would honestly highly recommend against using Teleconsole for those reasons.

No it is not. Connecting two machines behind two different NAT'ed networks requires a proxy of some kind, and there's nothing you already "have installed" that would help you.

Teleconsole is an instant VPN+SSH in one command and it would be wise to educate yourself on what it does (reading just the 1st sentence of the blog post would be a good start) before recommending anything.

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#78

Post by geofft »

broknbottle wrote: post #76
geofft wrote: post #43

Earlier quoted context omitted.

What's wrong with it? If you're claiming that you don't get the ability to audit the code, I'd like to watch you audit a ./configure shell script generated by GNU autoconf. If you're claiming that you want to apt-get install so the package maintainer has audited the code, I'd like to watch them audit the ./configure shell script. Downloading and auditing code from an untrusted source is security theatre. Don't instal…

if the connection closes mid stream it could potentially run something catastrophic (rm -rf /) as sh will execute the partial command in its buffer.

Yes. Wrap the entire script in a function and call the function at the end once the whole thing has transferred. https://install.sandstorm.io/ , for instance, does this.

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#79

Post by pferde »

robolange wrote: post #51
ryukafalz wrote: post #49

Earlier quoted context omitted.

>Yes if the https server is compromised there's a problem, but that's true with any other delivery method. That's not correct. In most distros, installing packages from your distro's repositories has an additional security guarantee: the packages you download have their PGP signatures verified before installation. If an attacker compromises the web server and alters the package, your package manager will reject it as…

That is true for distribution-hosted repositories. But how many web sites are there that are like, "Add this line to sources.list, then run this apt-key command, and then run apt-get install our-app." So few people bother to check for a web of trust for the proffered key (or even know how to, or even grok the concept) that there is little functional difference.

So if other people do it too, it's automatically good?
Post reply on HN