Earlier quoted context omitted.
Spoiler: set the user’s shell to any old binary, like a chat app.
I'd recommend using https://github.com/gliderlabs/ssh instead, no chance of some shell escape that way.
I use a fork of that!
Devzat – Chat over SSH, with some nice quality-of-life features
71–80 of 111 posts
Re: Devzat – Chat over SSH, with some nice quality-of-life features
#72Re: Devzat – Chat over SSH, with some nice quality-of-life features
#73what sort of server resource usage is this like right now as you are getting a ton of traffic? also noticed that people were able to run commands but permission denied. that kinda freaked me out. eventually somebody is going to figure out how to escape the go binary
im not worried at all :)
Re: Devzat – Chat over SSH, with some nice quality-of-life features
#74Earlier quoted context omitted.
yup, not an extensive list, but further demonstrative: - terminal emulators are not security hardened clients against malicious actors - ssh lacks PKI and is inconvenient so users never do prekeying in practice, so it's TOFU / zero server assertion in most practical cases (i.e. easy to mitm) - ssh channel features are a constant concern, for server resources and for client features like agents, agents are easy to dis…
ssh definitely supports PKI, it's just not the standard workflow for individuals ssh-keygen (1): ssh-keygen supports signing of keys to produce certificates that may be used for user or host authentication. Certificates consist of a public key, some identity information, zero or more principal (user or host) names and a set of options that are signed by a Certification Authority (CA) key. Clients or servers may then…
PKI, with I in bold quotation marks.
While it supports serial numbers, expiration dates and key revocation lists, it does not allow certificate chaining. That means whoever signs keys for end users has implicit access to the master key.
Re: Devzat – Chat over SSH, with some nice quality-of-life features
#75See also: ssh-chat by shazow from ~10 years ago written in Go ssh chat.shazow.net The most amazing part is perhaps the fact that this one is still around, 10 years later! Try it yourself and you’ll see :) Discussion at the time: https://news.ycombinator.com/item?id=8743374 Source code in GitHub repo here: https://github.com/shazow/ssh-chat
ssh-chat sort of inspired devzat. here's the story: I used to live in dubai at the time and for some odd dns reasons I could never actually join ssh-chat, but it acted as proof that ssh chats are possible, and so I decided to make my own version of it. then I moved to the us and was actually able to use both ssh-chat and devzat.
> odd dns reasons
I would love to hear more about this
Re: Devzat – Chat over SSH, with some nice quality-of-life features
#76Re: Devzat – Chat over SSH, with some nice quality-of-life features
#77I experimented with writing a shell replacement a while back. Turns out you can just run any old program. Here’s and example “hello world” shell replacement written in Go. https://github.com/codazoda/goshell
> Turns out you can just run any old program. It’s amazing how simple some things are. Similarly, an HTTP server can also run any old binary in response to an incoming request. As long as it produces output that looks like an HTTP response, the client will receive that response.
but nginx or caddy can't run CGIs, they want scalability to the billions.
Disclaimer: I build a personal social web server https://seppo.social like that on top of shared (apache) hosting requiring no root privileges to install and run.
Or with a few lines of sh you can turn many cli tools to web services like https://qr.mro.name/
Re: Devzat – Chat over SSH, with some nice quality-of-life features
#78Related: Does anyone by chance know how to configure an "anonymous" ssh account that always runs the same program? This would be great for making text mode games available to everyone without needing to support different platforms, now that windows actually ships with ssh.
customize https://github.com/gliderlabs/ssh I use it for funky.nondeterministic.computer
Thanks for the link! However, I will not touch the Google programming language.
Re: Devzat – Chat over SSH, with some nice quality-of-life features
#79I have a Raspberry Pi running a read-only server where some friends and I have a "poor man's IRC" chat, in that we all log in from Termux and post messages to one another using `wall`. It's absolutely ridiculous and I love it.
Re: Devzat – Chat over SSH, with some nice quality-of-life features
#80I have a Raspberry Pi running a read-only server where some friends and I have a "poor man's IRC" chat, in that we all log in from Termux and post messages to one another using `wall`. It's absolutely ridiculous and I love it.
It's one of those things that if you need to ask why, you'll never understand :-)