Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Invite friends to SSH into your laptop using their GitHub handle

gravitational.com

Post reply on HN
Print view View original

81–90 of 105 posts

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#81

Post by VeejayRampay »

problems wrote: post #16
reubensutton wrote: post #12

Earlier quoted context omitted.

Being unconstructively snarky about a concept that another member of this forum has presented is both poor manners and defies the guidelines linked in the bottom of the page

Just making a critique of the concept. Didn't think that was against any guidelines.

If you're going to start your sentence by the heavily condescending "Yeah, what a great idea", then don't pretend you don't understand how that could be against the rules. You can't have your lunch and eat it. Especially if you're not going to provide some facts / hard evidence to back up your assertion that this is, in fact, not a good idea.

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#82

Post by tribaal »

aleyan wrote: post #31

Neat. I use the following incantation when authorizing folks to ssh into my servers via github public keys: curl https://github.com/[github name].keys >> ~/.ssh/authorized_keys [github name] here should be replaced with github username of your friend or colleague. Really handy because I can just authorize them without a human request/response loop and manual key moving. Simple and no external tools needed. Normal cav…

If you are on an Ubuntu system you can do the same thing with a native utility, try:

ssh-import-id-gh

It also works with launchpad (of course):

ssh-import-id-lp

(It does exactly the same but is shorter to type)

EDIT: typo

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#83

Post by txutxu »

Publishing the public key that you use to push to github/gitlab is not a big issue... But Re-using your github key-pair, to connect to other unknown and uncontrolled places, _is_ a security issue.

Even re-using your daily system user, for this, is a security issue.

But if you never did read the sshd_config man page, or never did play with its options, maybe you're unaware of this.

Also the sshd could be modified at source level.

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#84

Post by sleepychu »

netsharc wrote: post #80

So how does the -i parameter know to look in a local file or on github for the public key? Does it look for a ".pub" in the filename? Feels clunky to me.

No. I was curious about that too, they check if the parameter is a file and if it's not they try and fetch the github user's keys. [0]

[0] - https://github.com/gravitational/teleconsole/blob/master/lib...

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#85

Post by kalmi10 »

txutxu wrote: post #83

Publishing the public key that you use to push to github/gitlab is not a big issue... But Re-using your github key-pair, to connect to other unknown and uncontrolled places, _is_ a security issue. Even re-using your daily system user, for this, is a security issue. But if you never did read the sshd_config man page, or never did play with its options, maybe you're unaware of this. Also the sshd could be modified at s…

Can you explain how this could be exploited (assuming that the user does not ignore warnings)?

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#86

Post by lucideer »

matt_wulfeck wrote: post #10

> ssh-import-I'd gh:my-gh-name That little command will pull down your GitHub public keys and add them to authorized key file for the user who runs it. Great for setting up new computers. I run it on boot-time for imbedded devices so that I can always access them.

That's cool, but it seems like a lot of code to do something that:

- You can do in one line of bash: curl https://github.com/user.keys >> ~/.ssh/authorized_keys - The bash one-liner is transparent and educational: it tells you clearly and intuitively where the keys are coming from and where they're going, educating users about the existence of the Github/Gitlab-published keys and about how the authorized_keys file works

You seem to require a lot of code, and lose a lot of very real advantages, for the sake of a bit of brevity. What are the other advantages of this tool?

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#88

Post by cfv »

kordless wrote: post #38
cfv wrote: post #23

What kind of abuse prevention measures does this have in place? As it stands it looks like a super convenient way to scp garbage into other people's computers and I'm not sure I'm sold on that.

You argument is biased and non-factual. Default ssh measures keep un-trusted entities from gaining access, normally. Conversely, once access is granted by the admin to trusted entities, the normal UNIX permissions continue to provide means by which access to the file system is limited by user permissions. Thus, simply by an admin granting access to a system, your (hypothetical) arguments become false and pointless to…

You must be kidding me. My "argument " is a question. My "hypotetical arguments" consist of me asking if there is some thing stopping people from scp'ing things to my computer then running them.

You talk like phishing and privilege escalation weren't things that exist. Have you ever managed any public-facing service of any importance?

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#89

Post by koolba »

lucideer wrote: post #86
matt_wulfeck wrote: post #10

> ssh-import-I'd gh:my-gh-name That little command will pull down your GitHub public keys and add them to authorized key file for the user who runs it. Great for setting up new computers. I run it on boot-time for imbedded devices so that I can always access them.

That's cool, but it seems like a lot of code to do something that: - You can do in one line of bash: curl https://github.com/user.keys >> ~/.ssh/authorized_keys - The bash one-liner is transparent and educational: it tells you clearly and intuitively where the keys are coming from and where they're going, educating users about the existence of the Github/Gitlab-published keys and about how the authorized_keys file wo…

Executing the curl command with no error checking and blindly appending it to your ~/.ssh/authorized_keys could easily bork the latter. Wrapping it in a fancy command allows for error checking and response validation. Otherwise you could end up the source of https://github.com/503.html in there!

Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle

#90

Post by koolba »

geofft wrote: post #43
giblfiz wrote: post #39

how is "curl https://www.teleconsole.com/get.sh | sh " Still considered even a remotely acceptable method for installation?

What's wrong with it? If you're claiming that you don't get the ability to audit the code, I'd like to watch you audit a ./configure shell script generated by GNU autoconf. If you're claiming that you want to apt-get install so the package maintainer has audited the code, I'd like to watch them audit the ./configure shell script. Downloading and auditing code from an untrusted source is security theatre. Don't instal…

At least wrap the dang thing in a function and execute the function. That way you don't get partial execution if the HTTP connection manages to die halfway through.
Post reply on HN