Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSH 8.2

lists.mindrot.org

Post reply on HN
Print view View original

51–60 of 61 posts

Re: OpenSSH 8.2

#51

Post by numlock86 »

jwilk wrote: post #33
numlock86 wrote: post #22

Earlier quoted context omitted.

> Just for fun, most users on Github have RSA keys exclusively. Rare ecdsa-sha2-nistp256 guy here. I'd welcome Brainpool, but support mostly boils down to NIST compromised curves on the majority of applications. sadface > Did you know that your SSH keys are public on Github? Wait, what? Github makes public keys public? Outrageous!

Why not ssh-ed25519?

> Why not ssh-ed25519?

> [...] but support mostly boils down to NIST compromised curves on the majority of applications.

I am doing a lot of embedded stuff, and usually all that's supported is RSA ... and NIST curves when it comes to ECC. And I like to keep my key count at 1. Ditching RSA for ECC was a huge step already in that regard.

Re: OpenSSH 8.2

#52

Post by lawnchair_larry »

techntoke wrote: post #23
RL_Quine wrote: post #8

Earlier quoted context omitted.

I haven't built the new version, but I assume it defaults to ed25519 now. You can otherwise make one with ssh-keygen -t ed25519.

Last time I tried AWS doesn't support anything but RSA keys.

This is good news, because AWS will finally be forced to get with the times. Their certificate manager is stuck on RSA too.

Re: OpenSSH 8.2

#53

Post by jlgaddis »

egyiedfyfrtjjf wrote: post #6
RL_Quine wrote: post #4

Earlier quoted context omitted.

Just for fun, most users on Github have RSA keys exclusively. Did you know that your SSH keys are public on Github? https://github.com/taylorotwell.keys https://github.com/alexcrichton.keys https://github.com/andrew.keys https://github.com/egoist.keys https://github.com/fabpot.keys Some of the most popular users even have DSS keys.

As a RSA-user myself, because I learnt about ssh through the github setup guides: Will ssh-keygen generate a secure key if I don’t pass it any parameters?

It will generate a 2048-bit RSA keypair by default. It will be "a secure key" as long as you protect it with an appropriate passphrase.

Re: OpenSSH 8.2

#54

Post by jlgaddis »

Steltek wrote: post #45
beefhash wrote: post #2

Notably from the changelog: It is now possible[1] to perform chosen-prefix attacks against the SHA-1 algorithm for less than USD$50K. For this reason, we will be disabling the "ssh-rsa" public key signature algorithm by default in a near-future release.

Can this be more simply achieved using the "KexAlgorithms" and "MACs" config settings for /etc/ssh/sshd_config and ~/.ssh/config ?

Sure, just remove "ssh-rsa" from the "HostKeyAlgorithms" list in /etc/ssh/sshd_config. For example, you might instead use:

  HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256
Myself, I've long set the (client-side) defaults on my workstations to

  HostKeyAlgorithms ssh-ed25519,ssh-rsa
but it looks like it may be time to update that.

Re: OpenSSH 8.2

#55

Post by boring_twenties »

dspillett wrote: post #35
RL_Quine wrote: post #28

Earlier quoted context omitted.

It's not intuitive because there's really no need for it.

No harm in it either though. Unless for some reason someone imports one into their authorized_keys (which presumably would require deliberate steps not random numbskullary) in which case there is a (low) risk as they have just given a dev access to an account said dev does not know exists.

The harm is that if you use the same key elsewhere, it can be linked to your github identity.

Re: OpenSSH 8.2

#56

Post by exabrial »

linsomniac wrote: post #42

As a (very) longtime user of SSH, are there any features in (relatively) newer releases that have changed peoples lives? Last year I switched over to using signed SSH host keys, and for my fleet of ~150 VMs, some of which respin on a nightly basis, this has been a game changer. No longer do I need to keep a master "known_hosts" file updated and distributed across the fleet.

Yes! Read the realease notes on U2F keys as SSH Keys; this means a cheap ($5-$25 USD) hardware key can now be used as an ssh key! These physical keys require a tap or physical touch to release a signature and are hardened against physical attack.

Re: OpenSSH 8.2

#57

Post by gnufx »

jlgaddis wrote: post #53
egyiedfyfrtjjf wrote: post #6

Earlier quoted context omitted.

As a RSA-user myself, because I learnt about ssh through the github setup guides: Will ssh-keygen generate a secure key if I don’t pass it any parameters?

It will generate a 2048-bit RSA keypair by default. It will be "a secure key" as long as you protect it with an appropriate passphrase.

You need recent ssh-keygen's -o to make the passphprase effective (default for ed25519). That was covered here at some stage, but I don't have a reference.

Re: OpenSSH 8.2

#58

Post by dspillett »

boring_twenties wrote: post #55
dspillett wrote: post #35

Earlier quoted context omitted.

No harm in it either though. Unless for some reason someone imports one into their authorized_keys (which presumably would require deliberate steps not random numbskullary) in which case there is a (low) risk as they have just given a dev access to an account said dev does not know exists.

The harm is that if you use the same key elsewhere, it can be linked to your github identity.

If you are needing to keep your identity hidden/ambiguous, then you need to be careful with your keys. Don't publish a public key if you don't want it to be public!

These keys and the ways people often used them are very much not designed with privacy as a priority: they are explicitly for proving who you are so you can be given access to something. Key management with regard to keeping different concerns separated is up to the user.

Re: OpenSSH 8.2

#59

Post by krabelize »

_-___________-_ wrote: post #3

Notable in this release is support for generating and using keys backed by FIDO/U2F tokens (and, with supported tokens, keys fully resident in FIDO/U2F tokens that you can transport between computers).

Works smoothly: https://cryptsus.com/blog/how-to-configure-openssh-with-yubi...
Post reply on HN