Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Devzat – Chat over SSH, with some nice quality-of-life features

github.com

Post reply on HN
Print view View original

61–70 of 111 posts

Re: Devzat – Chat over SSH, with some nice quality-of-life features

#61

Post by password4321 »

cwillu wrote: post #48
raggi wrote: post #47

Earlier quoted context omitted.

yup, not an extensive list, but further demonstrative: - terminal emulators are not security hardened clients against malicious actors - ssh lacks PKI and is inconvenient so users never do prekeying in practice, so it's TOFU / zero server assertion in most practical cases (i.e. easy to mitm) - ssh channel features are a constant concern, for server resources and for client features like agents, agents are easy to dis…

ssh definitely supports PKI, it's just not the standard workflow for individuals ssh-keygen (1): ssh-keygen supports signing of keys to produce certificates that may be used for user or host authentication. Certificates consist of a public key, some identity information, zero or more principal (user or host) names and a set of options that are signed by a Certification Authority (CA) key. Clients or servers may then…

TIL about PKIX-SSH, OpenSSH + X.509.

https://gitlab.com/secsh/pkixssh

http://tech.ciges.net/blog/openssh-with-x509-certificates-ho...

Right now I'd stick with something like Gravitational Teleport (overkill); Warpgate may become the perfect fit for this niche soon.

https://github.com/warp-tech/warpgate

It's also worth knowing about SSH clients that can use X.509 certificate keys as normal pre-shared keys with any SSH server, like PuttyCAC and built-in for macOS High Sierra and later.

https://www.idmanagement.gov/implement/scl-ssh/

Re: Devzat – Chat over SSH, with some nice quality-of-life features

#65

Post by zie »

password4321 wrote: post #61
cwillu wrote: post #48

Earlier quoted context omitted.

ssh definitely supports PKI, it's just not the standard workflow for individuals ssh-keygen (1): ssh-keygen supports signing of keys to produce certificates that may be used for user or host authentication. Certificates consist of a public key, some identity information, zero or more principal (user or host) names and a set of options that are signed by a Certification Authority (CA) key. Clients or servers may then…

TIL about PKIX-SSH, OpenSSH + X.509. https://gitlab.com/secsh/pkixssh http://tech.ciges.net/blog/openssh-with-x509-certificates-ho... Right now I'd stick with something like Gravitational Teleport (overkill); Warpgate may become the perfect fit for this niche soon. https://github.com/warp-tech/warpgate It's also worth knowing about SSH clients that can use X.509 certificate keys as normal pre-shared keys with any SSH…

OpenBAO and Hashicorp Vault also have built-in support for SSH certs: https://openbao.org/docs/secrets/ssh/signed-ssh-certificates...

Re: Devzat – Chat over SSH, with some nice quality-of-life features

#66

Post by fragmede »

jagged-chisel wrote: post #41
codazoda wrote: post #8

Earlier quoted context omitted.

Probably. See my comment (and example repo) elsewhere about running any old binary when someone connects.

Spoiler: set the user’s shell to any old binary, like a chat app.

I'd recommend using https://github.com/gliderlabs/ssh instead, no chance of some shell escape that way.

Re: Devzat – Chat over SSH, with some nice quality-of-life features

#67

Post by fragmede »

gerdesj wrote: post #59
kijin wrote: post #56

Earlier quoted context omitted.

I suppose this will also lock the user out of sftp and scp? Because otherwise they might be able to edit the authorized_keys file and run any command.

"I suppose this will also lock the user out of sftp and scp?" No it wont! The specified command might provide sftp, scp, telnet or stream a film.

I stream a film at funky.nondeterministic.computer on port 22

Re: Devzat – Chat over SSH, with some nice quality-of-life features

#68

Post by steve1977 »

jagged-chisel wrote: post #40
codazoda wrote: post #6

I experimented with writing a shell replacement a while back. Turns out you can just run any old program. Here’s and example “hello world” shell replacement written in Go. https://github.com/codazoda/goshell

> Turns out you can just run any old program. It’s amazing how simple some things are. Similarly, an HTTP server can also run any old binary in response to an incoming request. As long as it produces output that looks like an HTTP response, the client will receive that response.

good old cgi

Re: Devzat – Chat over SSH, with some nice quality-of-life features

#69

Post by lynx23 »

Related: Does anyone by chance know how to configure an "anonymous" ssh account that always runs the same program? This would be great for making text mode games available to everyone without needing to support different platforms, now that windows actually ships with ssh.

Re: Devzat – Chat over SSH, with some nice quality-of-life features

#70

Post by fragmede »

lynx23 wrote: post #69

Related: Does anyone by chance know how to configure an "anonymous" ssh account that always runs the same program? This would be great for making text mode games available to everyone without needing to support different platforms, now that windows actually ships with ssh.

customize https://github.com/gliderlabs/ssh

I use it for funky.nondeterministic.computer

Post reply on HN