121–130 of 169 posts
What does "PTY allocation request failed on channel 0" mean?
In this case the SSH server declines that request because it simply wants to send back one line of text. The client falls back to text mode and works fine, but issues the warning anyway. You can suppress it with `ssh -T mars.vtllf.org` like I did in the demo video.
I like alternative two, except that I'd have it be ssh @ auth This feels more natural to me and makes it easier to support other commands in the future should one wish to do so. Regarding the part where he said: >Running a custom SSH server along side a web server is not convenient. There is no good equivalent to the HTTP Host header, so hosting multiple SSH servers on a single IP address doesn’t work well. That's no…
Good point about the @ format, I like it much better too. You're right about tying tokens to host names, that would work. But you'd have to justify whether the extra complexity of multiple web servers preregistering tokens with a SSH front-end was worth it. Another approach would be embedding a static host identifier in the username as well. Although my knowledge of the SSH protocol isn't complete, a related issue ap…
SSH-protoversion-softwareversion SP comments CR LF
In the comment section of the message, you could add something like "X-Host: hostname.wherever.org" and a smart SSH server could proxy the connection to the correct host. This happens before the key exchange occurs, so you'd still get strong authentication from having the right key.
I checked through the OpenSSH and Paramiko code, and both essentially ignore the comment section of the version exchange - everything between the first space and the CR/LF at the end. They does hold on to it for part of the DH key exchange, but they never try to interpret the bytes, so a modified client could keep sending the X-Host extension and stock OpenSSH would just ignore it.
Earlier quoted context omitted.
I'm not sure I understand the question. Here's what gets typed: ssh foo.example.com #uses private/public key per conf file *enter password* cd app ruby script/console irb > u = User.find_by_email "customer@example.net" irb > u.authorize_ghosting! "Reason for log goes here." * you'll want to incognito mode the URL returned here* irb > exit exit
With all due love and respect: This is something I would wrap a simple CLI around, and then kick myself in the tukhus for having ever used the language's interactive client to make raw database queries and edits on the production server.
Earlier quoted context omitted.
Yet, if you call a public key/private key a lock/key respectively, then a lot more people would immediately get the concept. "You send him a copy of your lock which he uses to lock a package and return it to you. Then only your key can open it!" You immediately fix the problem of people sending their key, because people know keys are important and shouldn't be handed out to just anyone. The PKI people are brilliant.…
I've always wondered why we couldn't just call public keys locks. That would avoid so much confusion for first-time users.
[1] https://freedom-to-tinker.com/blog/randomwalker/why-king-geo...
ssh-keygen -R use [1] and generate a client side certificate for authentication? [1]: https://developer.mozilla.org/de/docs/Web/HTML/Element/keyge...
Very cool. This could be used to count linux users. Like http://linuxcounter.net/
Even the Ubuntu distro's opt-in share-my-desktop-stats system likely contains multiple times what Linux Counter is counting.
The author makes a very good case for why this approach won't threaten password-based authentication, including: ...hard for first-time users to get right:... The private key being unlocked and available via ssh-agent. For this to be convenient for daily use, ssh-agent is essential, and that could expose naive users to compromise. I know enough to disable ForwardAgent in my personal config by default and generate sit…
Earlier quoted context omitted.
With all due love and respect: This is something I would wrap a simple CLI around, and then kick myself in the tukhus for having ever used the language's interactive client to make raw database queries and edits on the production server.
'find_by_email' is what counts as a raw database query these days? I feel so old.