41–50 of 111 posts
I wonder if you could do something similar with an ssh account which is hard-wired to run 'ytalk' ( https://en.wikipedia.org/wiki/Talk_(software) ).
Probably. See my comment (and example repo) elsewhere about running any old binary when someone connects.
See also: ssh-chat by shazow from ~10 years ago written in Go ssh chat.shazow.net The most amazing part is perhaps the fact that this one is still around, 10 years later! Try it yourself and you’ll see :) Discussion at the time: https://news.ycombinator.com/item?id=8743374 Source code in GitHub repo here: https://github.com/shazow/ssh-chat
ssh-chat sort of inspired devzat. here's the story: I used to live in dubai at the time and for some odd dns reasons I could never actually join ssh-chat, but it acted as proof that ssh chats are possible, and so I decided to make my own version of it. then I moved to the us and was actually able to use both ssh-chat and devzat.
Any idea what we could do to allow all of the people still in Dubai to join chats over ssh too?
I'd be curious whether there's any security concerns on this one. Could an attacker craft a message that gets access to execute commands into a client terminal?
Is there a usable description somewhere on how to do this safely?
also noticed that people were able to run commands but permission denied. that kinda freaked me out. eventually somebody is going to figure out how to escape the go binary
I'd be curious whether there's any security concerns on this one. Could an attacker craft a message that gets access to execute commands into a client terminal?
I'm also interested. Setting up a passwordless SSH account for some public service sounds like a good way to give your machine away to North Korean hackers, because you forgot to set someting in /etc/sshd to "no". Is there a usable description somewhere on how to do this safely?
Earlier quoted context omitted.
This is not sshd, this is a golang binary that uses the stdlib ssh lib. You would have to either a) figure out how to escape out of a golang binary, or b) if the go code executes shell commands with some user provided text, trying to shell inject something in there.
Or convince the ssh daemon to pass on terminal escape codes to another user. https://nvd.nist.gov/vuln/detail/CVE-2021-33477
- terminal emulators are not security hardened clients against malicious actors
- ssh lacks PKI and is inconvenient so users never do prekeying in practice, so it's TOFU / zero server assertion in most practical cases (i.e. easy to mitm)
- ssh channel features are a constant concern, for server resources and for client features like agents, agents are easy to disable
- most ssh implementations don't scale that well, it wasn't ever really a goal to do so
- there are few tools for auditing and monitoring, unlike the common protocols/services/clients
Earlier quoted context omitted.
Or convince the ssh daemon to pass on terminal escape codes to another user. https://nvd.nist.gov/vuln/detail/CVE-2021-33477
yup, not an extensive list, but further demonstrative: - terminal emulators are not security hardened clients against malicious actors - ssh lacks PKI and is inconvenient so users never do prekeying in practice, so it's TOFU / zero server assertion in most practical cases (i.e. easy to mitm) - ssh channel features are a constant concern, for server resources and for client features like agents, agents are easy to dis…
ssh-keygen (1):
ssh-keygen supports signing of keys to produce certificates that may be used for user or host authentication.
Certificates consist of a public key, some identity information, zero or more principal (user or host) names and
a set of options that are signed by a Certification Authority (CA) key. Clients or servers may then trust only
the CA key and verify its signature on a certificate rather than trusting many user/host keys. Note that
OpenSSH certificates are a different, and much simpler, format to the X.509 certificates used in ssl(8)Earlier quoted context omitted.
yup, not an extensive list, but further demonstrative: - terminal emulators are not security hardened clients against malicious actors - ssh lacks PKI and is inconvenient so users never do prekeying in practice, so it's TOFU / zero server assertion in most practical cases (i.e. easy to mitm) - ssh channel features are a constant concern, for server resources and for client features like agents, agents are easy to dis…
ssh definitely supports PKI, it's just not the standard workflow for individuals ssh-keygen (1): ssh-keygen supports signing of keys to produce certificates that may be used for user or host authentication. Certificates consist of a public key, some identity information, zero or more principal (user or host) names and a set of options that are signed by a Certification Authority (CA) key. Clients or servers may then…
Earlier quoted context omitted.
Probably. See my comment (and example repo) elsewhere about running any old binary when someone connects.
Spoiler: set the user’s shell to any old binary, like a chat app.
command="/usr/bin/foo" ssh-ed25519 AAAA....