SSH Agent Explained • Hacker News Board

Re: SSH Agent Explained

#11

Post by ptman » Wed, May 20, 2020, 7:52 AM UTC

volodymyrs wrote: post #9

What I am missing is why ever use ssh agent, including any re-enforced variations, if ProxyJump has none of the ssh agent issues and has little to no other disadvantages?

ssh-agent is very useful, it's agent forwarding that is better handled with proxyjump. And my guess would be that forwarding came first and proxyjump only later.

Re: SSH Agent Explained

#12

Post by ncmncm » Wed, May 20, 2020, 7:52 AM UTC

Cool, didn't know about -J! I have been using dodgy port forwarding all this time.

Now I just need to set up my Somu, and I will be living in 2020.

Re: SSH Agent Explained

#13

Post by ncmncm » Wed, May 20, 2020, 7:54 AM UTC

volodymyrs wrote: post #9

What I am missing is why ever use ssh agent, including any re-enforced variations, if ProxyJump has none of the ssh agent issues and has little to no other disadvantages?

ProxyJump doesn't help with the use cases cited in the tl;dr^Wintroduction.

Re: SSH Agent Explained

#14

Post by skookum-skuad » Wed, May 20, 2020, 8:37 AM UTC

I skip ssh-agent and use gpg-agent instead, which does both ssh and gpg agenting. Combined with monkeysphere, I store ssh private keys in gpg rather than in the encrypted ssh format.

Re: SSH Agent Explained

#15

Post by skookum-skuad » Wed, May 20, 2020, 8:39 AM UTC

gbin wrote: post #2

Nit: The TL;DR is what is called an introduction.

Yep.

TL;DR = extreme executive summary

Intro = introduction

Same number of letters, but different meanings

It's not a big deal, but the armchair lawyer in me cringes and throws an OCD tantrum when spelling, grammar, semantics, and linguistic conventions are abused. "Weight at the busstop" or "u know what i mean thatswut im saying haha he even said it tiwce" :sigh: :meta-sigh:

Re: SSH Agent Explained

#16

Post by mkj » Wed, May 20, 2020, 12:11 PM UTC

SSH agent has other interesting possibilities too - it's an opaque channel from far server to your local machine, there must be various cool hacks you could do.

Years ago I wrote something to copy a file from a remote machine to my desktop over ssh-agent, worked well back then. https://matt.ucc.asn.au/ssh-xfer/

Re: SSH Agent Explained

#17

Post by undecidabot » Wed, May 20, 2020, 12:19 PM UTC

mmalone wrote: post #6

keithwinstein wrote: post #4

Thanks for this. Wanted to put in a pitch for Dima Kogan's more-secure way of doing ssh-agent forwarding: https://github.com/StanfordSNR/guardian-agent It works with SSH and Mosh. The basic idea is that before agreeing to a request, the principal or their agent should know (a) what machine is asking, (b) what remote machine they want to connect to, and (c) what command line they want to run on the principal's behalf.…

YES. It would be so easy for OpenSSH to fix agent forwarding. Just need to limit authority and/or ask for consent for a particular action.

You can configure ssh-agent to ask for confirmation if you set the `-c` flag in ssh-add or by setting `AddKeysToAgent` to `confirm` in your ssh config [1].

Once set, authentication will require confirmation via a GUI dialog provided by the ssh-askpass command. However, it does not mention the command or process requesting for authentication.

It works great on Linux, but I couldn't get it to work on macOS with the system keychain.

[1] https://man.openbsd.org/ssh_config.5#AddKeysToAgent

Re: SSH Agent Explained

#18

Post by pritambaral » Wed, May 20, 2020, 12:49 PM UTC

volodymyrs wrote: post #9

What I am missing is why ever use ssh agent, including any re-enforced variations, if ProxyJump has none of the ssh agent issues and has little to no other disadvantages?

1. Agent was designed to solve a larger problem; ProxyJump to solve a specialised subset of that problem.

2. The issues and disadvantages claimed with Agent Forwarding don't actually exist anymore: https://news.ycombinator.com/item?id=22753590

Re: SSH Agent Explained

#19

Post by ganstyles » Wed, May 20, 2020, 1:09 PM UTC

I restart my computer pretty infrequently and everytime I do, I can't connect to various things. Inevitably I realize I didn't run ssh-add and after debugging, things work again once I have run this command. But I never really looked into the basics.

Thanks to this article I realize why I need to do that every time. :)

Re: SSH Agent Explained

#20

Post by bogomipz » Wed, May 20, 2020, 1:13 PM UTC

The author states:

>"Later in the handshake process, a set of new, ephemeral and symmetric keys are generated and used to encrypt the SSH session traffic."

This isn't correct. After the TCP handshake, both systems agree on a session key by using the Diffie-Hellman key exchange. It's only after establishing a session key that user authentication takes place. There's a re-keying event but that's not part of the initial handshake and only happens later when some threshold(time or blocks) has been reached.