Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH Agent Explained

smallstep.com

Post reply on HN
Print view View original

21–30 of 50 posts

Re: SSH Agent Explained

#21

Post by bogomipz »

oxplot wrote: post #7

Something that's skimmed over in the article but not addressed is: if the key pair isn't used for encryption, then how are session keys protected? The answer is: using the server's public key which is transmitted to client when establishing the connection. But then it's trivial to perform a person-in-the-middle attack and both observe and manipulate the plain text data by sending the client the attacker's public key.…

>"The answer is: using the server's public key which is transmitted to client when establishing the connection."

This was true in SSH v1 which is ancient but in modern times v2 uses DH and the the server's pub key is only used to sign the DH parameters.

Re: SSH Agent Explained

#22

Post by rkeene2 »

One thing I like to do with the SSH Agent is also forward my X.509 certificates by adding new opcodes to the SSH Agent protocol, then you can do stuff like PKCS#11 on the remote side with your local smartcard. [0]

This gives you, among other things, passwordless but authenticated "sudo" capability (which is actually required by the DOD, though nobody does it).

[0] http://cackey.rkeene.org/fossil/artifact/0d0e90bbfdee672c?ln...

Re: SSH Agent Explained

#23

Post by rkeene2 »

rkeene2 wrote: post #22

One thing I like to do with the SSH Agent is also forward my X.509 certificates by adding new opcodes to the SSH Agent protocol, then you can do stuff like PKCS#11 on the remote side with your local smartcard. [0] This gives you, among other things, passwordless but authenticated "sudo" capability (which is actually required by the DOD, though nobody does it). [0] http://cackey.rkeene.org/fossil/artifact/0d0e90bbfdee…

Forgot to include a link the PKCS#11 module which talks to the SSH Agent: [0]

[0] https://chiselapp.com/user/rkeene/repository/ssh-agent-pkcs1...

Re: SSH Agent Explained

#24

Post by vagab0nd »

I regularly ssh into boxes with varying IPs. Something like "ssh -i @". Every time I want to scp a file, I quit the ssh session, press UP, modify the ssh command into an scp one, execute then restore the ssh session. It's slow and annoying.

Does anyone know of a way to use scp without hassle, once ssh session is established?

Re: SSH Agent Explained

#25

Post by beagle3 »

vagab0nd wrote: post #24

I regularly ssh into boxes with varying IPs. Something like "ssh -i @ ". Every time I want to scp a file, I quit the ssh session, press UP, modify the ssh command into an scp one, execute then restore the ssh session. It's slow and annoying. Does anyone know of a way to use scp without hassle, once ssh session is established?

Use session sharing (ControlMaster setting). Then, don't quit your session - in another terminal on the same computer, run your scp command, and it will use the existing session (and its authentication), without need for -i.

Alternatively, ssh-add is your friend.

(But for security, make sure you do not forward ssh-agent unless you understand the risks)

Re: SSH Agent Explained

#26

Post by inetknght »

keithwinstein wrote: post #4

Thanks for this. Wanted to put in a pitch for Dima Kogan's more-secure way of doing ssh-agent forwarding: https://github.com/StanfordSNR/guardian-agent It works with SSH and Mosh. The basic idea is that before agreeing to a request, the principal or their agent should know (a) what machine is asking, (b) what remote machine they want to connect to, and (c) what command line they want to run on the principal's behalf.…

> The basic idea is that before agreeing to a request, the principal or their agent should know (a) what machine is asking, (b) what remote machine they want to connect to, and (c) what command line they want to run on the principal's behalf. And the principal's authorization should then be limited to that context.

Holy snap this is exactly the reason that I've gone to great lengths to disable SSH Agents and askpass. Asking for a password without any context whatsoever of exactly which process is wanting it is a nightmare

Re: SSH Agent Explained

#27

Post by hylaride »

vagab0nd wrote: post #24

I regularly ssh into boxes with varying IPs. Something like "ssh -i @ ". Every time I want to scp a file, I quit the ssh session, press UP, modify the ssh command into an scp one, execute then restore the ssh session. It's slow and annoying. Does anyone know of a way to use scp without hassle, once ssh session is established?

You can setup an `~/.ssh/config` file to make it easier:

  Host *
   ControlMaster auto
   ControlPath ~/.ssh/ssh_mux_%h_%p_%r
  Host host1
   HostName 1.2.3.4
   LocalForward 45432 db.internal.net:5432
   User user1
  Host host2
   HostName host2.whatever.com
   LocalForward 46432 db2.internal.net:5432
   User user2
This way you can now scp/ssh to user1@1.2.3.4 with just this:

  scp file host1:
  ssh host1
It also setups up port forwarding. In that case I can connect a postgresql client to localhost 45432 and it'll forward (assuming the ssh host has network access to it) the tcp connection to the host db.internal.net . I do this to use GUI SQL clients to our back-end DB.

The Control options setup ssh multiplexing. If you ssh into a host, subsequent connections piggy-back off of the initial connection. This is useful if you have 2fa and don't want to do 2 factor for every connection.

There's much more you can do: https://linux.die.net/man/5/ssh_config

Re: SSH Agent Explained

#28

Post by dooglius »

The problem is that this breaks with use of tmux or similar tools since the scope of the SSH session is often smaller than the scope of my doing something on a machine. I've moved to just having a limited-use key with access to dev machines and git on the hard drive of each machine I use, which covers the cases I care about.

Re: SSH Agent Explained

#29

Post by tialaramex »

keithwinstein wrote: post #4

Thanks for this. Wanted to put in a pitch for Dima Kogan's more-secure way of doing ssh-agent forwarding: https://github.com/StanfordSNR/guardian-agent It works with SSH and Mosh. The basic idea is that before agreeing to a request, the principal or their agent should know (a) what machine is asking, (b) what remote machine they want to connect to, and (c) what command line they want to run on the principal's behalf.…

At first glance guardian-agent seems to be focused on a happy path where the remote systems are honest. Clearly agent forwarding attacks would mostly involve dishonest (or at least corrupt) remote systems and if guardian-agent specifically defeats that rather than just punting I don't see how in this summary.

Re: SSH Agent Explained

#30

Post by lisper »

A pithy way of explaining all this: ssh-agent is exactly like a U2F token but implemented in software and using a slightly different protocol. But both do the same thing and serve the same purpose.
Post reply on HN