Show HN: My SSH server knows who you are

Post by chrisfosterelli » Tue, Aug 04, 2015, 9:55 PM UTC

FiloSottile wrote: post #140

chrisfosterelli wrote: post #30

FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.…

Double-reading the man page I noticed that IdentitiesOnly makes ssh only send IdentityFile keys, however IdentityFile has a default of "~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519 and ~/.ssh/id_rsa". The result is that with this configuration you would still send id_rsa to unknown hosts. You also need to add "PubkeyAuthentication no" to your global stanza, and re-enable it for good hosts. # Ignore ssh-agent key…

Post by JoshTriplett » Tue, Aug 04, 2015, 9:59 PM UTC

javajosh wrote: post #130

phamilton wrote: post #115

Earlier quoted context omitted.

For those who don't get why this is terrible, imagine if GitHub were compromised and their ssh agent tampered with. When you clone a repo, they could use your forwarded agent to log into your production hosts. That's pretty bad.

I don't fully understand how this would work - the key being "forwarded agent". My (poor) understanding is that in order for compromised github to get to a host I'm connected to they would somehow need to invoke ssh on my host, somehow. The only way that would not be the case is if ssh maintains an in-memory persistent thing that a) maintains connections to foreign hosts, and b) can somehow be signaled from active co…

Post by ipozgaj » Tue, Aug 04, 2015, 10:09 PM UTC

chrisfosterelli wrote: post #30

FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.…

Post by kaybe » Tue, Aug 04, 2015, 10:21 PM UTC

simme_ wrote: post #142

kaybe wrote: post #84

Earlier quoted context omitted.

The best moron I ever saw had his full name as computer name and we gave him a phone call at his house - his mother answered first, it was awesome!

You don't happen to have recordings of it, by chance?

Post by scintill76 » Tue, Aug 04, 2015, 10:35 PM UTC

JoshTriplett wrote: post #70

FiloSottile wrote: post #57

Earlier quoted context omitted.

Exactly! Once I get the keys I just check them against a scraped database of GitHub keys and ask the API for your name. (And if you have agent forwarding active I show you a big WARNING [0].) There's an explanation in the README [1] but the actually interesting stuff is in server.go [2]. Finally I mentioned a few reasons it might not work for you below [3]. [0] http://git.io/vOVYm [1] https://github.com/FiloSottile/w…

> (And if you have agent forwarding active I show you a big WARNING [0].) It amazes me that people enable that for random servers. Seems like SSH should make that harder. Enabling it for a specific server you trust makes sense; enabling it for all servers doesn't. SSH could reject "ForwardAgent" outside a Host block, for instance, and force you to at least write a "Host *" block. EDIT: Check out this search: https://…