SSH agent notifications for OS X • Hacker News Board

Re: SSH agent notifications for OS X

#21

Post by dteske » Sun, May 04, 2014, 8:03 PM UTC

IgorPartola wrote: post #18

I use a different method for this: I get a dialog that asks me Allow/Deny every time the key is being used. All it requires is two shell scripts. It is a modification of a method I found on GitHub. Perhaps I should put these scripts out there and share them with HN next week when I am back at the office. That way the tutorial is about 4 times shorter and all the components are open source.

This would be interesting. Would look forward to an HN post on this.

Re: SSH agent notifications for OS X

#22

Post by Yoshino » Sun, May 04, 2014, 9:22 PM UTC

FiloSottile wrote: post #4

This is pretty cool, and having notifications when the agent is used is really a good security bonus. So I'm pretty sad that I can't have this (requires Apple binary) AND a decently recent version of OpenSSH: $ /usr/local/bin/ssh -V OpenSSH_6.6p1, OpenSSL 1.0.1g 7 Apr 2014 $ /usr/bin/ssh -V OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011 BUT, please think twice, thrice before installing a ssh-agent binary compiled by a str…

Homebrew's openssh formula include a patch for Keychain support:

    $ brew info openssh
    openssh: stable 6.6p1
    ...
    ==> Options
    --with-keychain-support
        Add native OS X Keychain and Launch Daemon support to ssh-agent
    --with-ldns
        Build with lens support

Perhaps you could add the notification patch to Homebrew's openssh and get the best of both worlds?

Re: SSH agent notifications for OS X

#23

Post by TimZehta » Mon, May 05, 2014, 5:33 PM UTC

Protect against SSH Agent Hijacking on Mac OS X with the ability to confirm agent identities prior to each use

https://github.com/TimZehta/mac-ssh-confirm

Does not require compiling, only XQuartz installation.