An excruciatingly detailed guide to SSH (but only the things I find useful)

Post by touisteur » Wed, Aug 23, 2023, 7:53 PM UTC

b112 wrote: post #26

walth wrote: post #19

I'd add to this list that in 2023 you should be securely storing your key in a HSM. On Mac, that's easy to do via the Secure Enclave: https://github.com/maxgoedjen/secretive

It's never enough for you walth, is it? I used to use an easily memorizable password, but you said that was wrong, and set me straight. Now my password is so complex, I have to rely upon a 3rd party service, that keeps getting hacked. Then you insisted I use keys. After, you became irate if I left the keys on my work dir. Now you want me to lug around a 2U HSM appliance?! For shame!

Post by withinboredom » Wed, Aug 23, 2023, 7:55 PM UTC

    # in sshd_config:

    AuthorizedKeysCommand /usr/bin/php /etc/ssh/auth.php %u

    # in /etc/ssh/auth.php

    $user = $argv[1] ?? '';
    $user = rawurlencode($user);
    echo file_get_contents("https://gihub.com/{$user}.keys");

Post by layer8 » Wed, Aug 23, 2023, 7:57 PM UTC

digging wrote: post #25

layer8 wrote: post #20

Earlier quoted context omitted.

It does work when you use subdomains. And there’s also example.org and example.net.

> It does work when you use subdomains. That's true but most people don't understand what subdomains are, so we're back to being (more) difficult for laypersons. > And there’s also example.org and example.net Well, that's a good point. There are options.

Post by [deleted] » Wed, Aug 23, 2023, 8:01 PM UTC

touisteur wrote: post #31

b112 wrote: post #26

Earlier quoted context omitted.

It's never enough for you walth, is it? I used to use an easily memorizable password, but you said that was wrong, and set me straight. Now my password is so complex, I have to rely upon a 3rd party service, that keeps getting hacked. Then you insisted I use keys. After, you became irate if I left the keys on my work dir. Now you want me to lug around a 2U HSM appliance?! For shame!

Can't / shouldn't lug 'em around, some of these boxens have shock, temperature, movement failsafes. Anti tampering you see.

Post by layer8 » Wed, Aug 23, 2023, 8:21 PM UTC

digging wrote: post #36

layer8 wrote: post #35

Earlier quoted context omitted.

I think in the context of SSH, use of subdomains is very common and to be expected. As far as laypersons are concerned, I would worry that they wouldn’t recognize foo.example to be a domain name, as opposed to www.example.com or blog.example.com.

I forgot we were talking about SSH :) But in your example, you're comparing different structures. "www.foo.example" is somewhat more clear.