Live data from Hacker News

SSH agent notifications for OS X

devinteske.com

1–10 of 23 posts

Re: SSH agent notifications for OS X

#4
This is pretty cool, and having notifications when the agent is used is really a good security bonus. So I'm pretty sad that I can't have this (requires Apple binary) AND a decently recent version of OpenSSH:

    $ /usr/local/bin/ssh -V
    OpenSSH_6.6p1, OpenSSL 1.0.1g 7 Apr 2014

    $ /usr/bin/ssh -V
    OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
BUT, please think twice, thrice before installing a ssh-agent binary compiled by a stranger. You're hiring that binary to really hold your keys. You have to be really sure you can trust it.

Re: SSH agent notifications for OS X

#5

This is pretty cool, and having notifications when the agent is used is really a good security bonus. So I'm pretty sad that I can't have this (requires Apple binary) AND a decently recent version of OpenSSH: $ /usr/local/bin/ssh -V OpenSSH_6.6p1, OpenSSL 1.0.1g 7 Apr 2014 $ /usr/bin/ssh -V OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011 BUT, please think twice, thrice before installing a ssh-agent binary compiled by a str…

you can also patch and compile https://github.com/devinteske/apple/commit/296d954851dbba238...

Or if you're on linux https://github.com/gdestuynder/openssh-portable/commit/bb0e9...

Or if you use gnupg https://github.com/gdestuynder/gnupg-agent-notification/comm...

Or if you use Windows and Putty https://github.com/gdestuynder/putty-pagent-notification (binary https://github.com/gdestuynder/putty-pagent-notification/rel...)

that's all i found

Re: SSH agent notifications for OS X

#7

This is pretty cool, and having notifications when the agent is used is really a good security bonus. So I'm pretty sad that I can't have this (requires Apple binary) AND a decently recent version of OpenSSH: $ /usr/local/bin/ssh -V OpenSSH_6.6p1, OpenSSL 1.0.1g 7 Apr 2014 $ /usr/bin/ssh -V OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011 BUT, please think twice, thrice before installing a ssh-agent binary compiled by a str…

The source code can be compiled by cloning https://github.com/devinteske/apple and then:

cd OpenSSH-186/openssh ./configure --with-pam --with-audit=bsm make

You can see from my commits at the following URL what I had to change to add support for Notification Center.

https://github.com/devinteske/apple/tree/master/OpenSSH-186/...

Namely I changed the following:

openssh/Makefile.in openssh/ssh-agent.c openssh/ssh-agent-notify.m [new] openssh/ssh-agent-notify.h [new]

As for the OpenSSH version, Apple forks OpenSSH and then adds things like Keychain and launchd(8) support. So if you want a later version while retaining those features, you'll have to get Apple's customizations applied to a later non-Apple version or wait until Apple does it themselves. Migrating my changes into a non-Apple version simply to say you have the latest version of OpenSSH would mean that you lose keychain and launchd(8) integration. -- Devin

Re: SSH agent notifications for OS X

#9

What changed with Mavericks? I recall seamless ssh-agent support for years in OS X. Similar to how Gnome and Unity have also done this for years. This article is another example of how nifty launchd is.

What's changed is that in Mavericks (really Mountain Lion or higher) we have the Notification Center. No longer do we have to rely on 3rd party software such as Growl to get notifications. However, Apple has not yet hooked ssh-agent into the Notification Center. This blog starts off kind of slow by first introducing folks not familiar with the existing Keychain/launchd integration and then goes on to follow that up by talking about future integration with Notification Center (providing working code and binary for others to experience a Notification Center aware ssh-agent). -- Devin

Re: SSH agent notifications for OS X

#10
post #2

Thats pretty slick. I've been wanting SSH key/Keychain integration since I made the switch to the Mac.

Hasn't OS X had ssh key/keychain integration for at least a couple years?

It has, but not notification center integration to nag you when it's used -- helpful for good security.
Post reply on HN