Why aren’t we using SSH for everything? • Hacker News Board

Re: Why aren’t we using SSH for everything?

#81

Post by nickpresta » Sat, Jan 03, 2015, 4:08 AM UTC

peterwwillis wrote: post #73

What the...? Does the author just not know anything about SSH, or web browsers? Why would we use SSH for everything? On top of the fact that they're entirely different protocols and tools designed for entirely different purposes, browsers already support virtually everything SSH does. File transfers, authentication, client certs, multiplexing, key pinning, etc. There is no need to use SSH, and if you did, it would be…

What does this even mean?

Your browser supports those things because it implements protocols, like HTTP, TLS, and others. Your browser, or other tools, could support SSH, which I think is the point of the article.

Re: Why aren’t we using SSH for everything?

#82

Post by 101914 » Sat, Jan 03, 2015, 4:39 AM UTC

MOre interesting question: Why aren't we using SSH-style authentication for everything? And although they can be used with SSH, I do not mean certificates.

Re: Why aren’t we using SSH for everything?

#83

Post by codingthebeach » Sat, Jan 03, 2015, 5:06 AM UTC

It was difficult for me to get past the self-referential (and reverential) tone of the writing, which felt more like an advertisement for the author's cleverness than a real discussion of the pros and cons of SSH, but it could be I woke up on the wrong side of the bed this morning.

Re: Why aren’t we using SSH for everything?

#84

Post by iancarroll » Sat, Jan 03, 2015, 5:42 AM UTC

101914 wrote: post #82

MOre interesting question: Why aren't we using SSH-style authentication for everything? And although they can be used with SSH, I do not mean certificates.

I don't see why client side certificate authentication is excluded? You can easily self sign and create your own CA. There aren't really any downsides. Putty with cryptoapi support exists.

Re: Why aren’t we using SSH for everything?

#85

Post by dredmorbius » Sat, Jan 03, 2015, 6:33 AM UTC

bondolo wrote: post #69

Key management is pretty primitive. It would be nice if SSH integrated better with PGP/GPG. I recently spent too much time messing with monkeysphere, keychain, gpg-agent, gpgsm etc. trying to use GPG derived keys for SSH. While I could cobble something together I didn't feel that it was a solution I could recommend to others as a general "best practice" because it involved too much installing and configuring and was…

But SSH keys really don't matter.

In PGP/GPG, key persistence matters because you're using them to decrypt messages. Long after content was created you may need the key to decrypt it.

For SSH, the key is only strictly necessary during the session. Key distribution* (of your public key to systems you need access to) is a bit of a pain, but between having your private key(s) where you need them, and authorized keys on various servers, there's not all that much to worry about. Host keys, perhaps, if you want to be rigorous about security.

Re: Why aren’t we using SSH for everything?

#86

Post by Sevrene » Sat, Jan 03, 2015, 7:13 AM UTC

dsl wrote: post #78

kgilpin wrote: post #67

Something else worth mentioning; SSH has built-in support for single-sign-on, via SSH agent forwarding. As long as my public key is available anywhere (and that's exactly what it's designed for), then I can be authenticated by any system, anywhere. Thus, a problem which is so vexing in so many other scenarios, is very cleanly addressed by SSH. Fundamentally, a password is a shared secret. So you send your password to…

SSH agent forwarding is extremely risky. Anyone with appropriate permissions (legitimate or illegitimately gained) on a machine you have connected to can use your credentials to open a new connection to any machine you have access to.

This is a very valid issue. I have been using ssh-ident* for this reason. You can add keys to ~/.ssh/identities and it'll start up an agent for each identity when you use it. This means if the machine you connect to is indeed stealing your keys, at least they only have one key, not all the keys you're currently using.

There are some caveats; such as having to specify what domains/IPs should use which identity, and also having to alias ssh to get it to work nicely. So it's not perfect, but it does solve the problem you talked about.

* https://github.com/ccontavalli/ssh-ident

Re: Why aren’t we using SSH for everything?

#87

Post by btown » Sat, Jan 03, 2015, 7:21 AM UTC

dsl wrote: post #78

kgilpin wrote: post #67

Something else worth mentioning; SSH has built-in support for single-sign-on, via SSH agent forwarding. As long as my public key is available anywhere (and that's exactly what it's designed for), then I can be authenticated by any system, anywhere. Thus, a problem which is so vexing in so many other scenarios, is very cleanly addressed by SSH. Fundamentally, a password is a shared secret. So you send your password to…

SSH agent forwarding is extremely risky. Anyone with appropriate permissions (legitimate or illegitimately gained) on a machine you have connected to can use your credentials to open a new connection to any machine you have access to.

> on a machine you have connected to

Don't you have to be actively connected to the machine for this to work? i.e. the server I haven't connected to for a few months has no way of opening connections on my behalf at this point, right?

Re: Why aren’t we using SSH for everything?

#88

Post by beagle3 » Sat, Jan 03, 2015, 7:28 AM UTC

btown wrote: post #87

dsl wrote: post #78

Earlier quoted context omitted.

SSH agent forwarding is extremely risky. Anyone with appropriate permissions (legitimate or illegitimately gained) on a machine you have connected to can use your credentials to open a new connection to any machine you have access to.

> on a machine you have connected to Don't you have to be actively connected to the machine for this to work? i.e. the server I haven't connected to for a few months has no way of opening connections on my behalf at this point, right?

You are right.

But once you connect, a year later - in those 3 minutes before you disconnect, the attacker might have authenticated as yourself to 100 other machines -- and appended their own key to .ssh/authorized_keys on these machines, so that the compromise no longer needs you to be connected.

Re: Why aren’t we using SSH for everything?

#89

Post by beagle3 » Sat, Jan 03, 2015, 7:35 AM UTC

ivansavz wrote: post #34

Isn't there a problem when you tunnel TCP over TCP with increasing window sizes (auto throttling mechanism meant to prevent packet fragmentation)? Every time I've tried to keep a long-running ssh tunnel for printing / http, the connection degrades after a while. I'm sure there are some flags that can be set, but I thought this was the major show stopper for the "everything over shh" (since ssh uses TCP protocol)

Simple port tunnelling (-L and -R command line arguments) do not suffer from TCP over TCP. And if you want VPN-style usage, look into sshuttle. It is one way only, and that's a good thing! (Most of the time you only need connections going one way and none going the other way). If you do want two way, either use two sshuttle connections (one each way) or OpenVPN.

The only thing about sshuttle that I've encountered that exposes it's non-VPNness, is that the connection truly originate from the remote system - e.g. if you connect through sshuttle to your peer, the connection go from the peer to the peer on 127.0.0.1. That may or may not be a problem (e.g., logging is much less useful this way).

Try sshuttle. I've stopped using VPNs since I started.

Re: Why aren’t we using SSH for everything?

#90

Post by beagle3 » Sat, Jan 03, 2015, 7:41 AM UTC

XorNot wrote: post #22

falcolas wrote: post #9

Neat trick, if you're so inclined to use such tricks: $ cat .ssh/authorized_keys command="tmux new-session -A -s base" ssh-rsa [...] Automatically creates or joins a tmux session named base, and disconnects the SSH session when you disconnect from the tmux session. So, yeah, why don't we use SSH for more?

It's multiplexing support uses static sized windows, which even on modern LANs means you usually only see 3-5 mb/s transfer rates where you should be able to - even with encryption overhead - achieve almost gigabit NIC speed. Fortunately the HPN-SSH patches exist to solve this problem - but I really want to know why their's so much resistance to adding them upstream.

> means you usually only see 3-5 mb/s

I see over 50Mb/s (=~400Mb/s) on a gb network without any attempts at optimization, between a stupid Atom machine and a fast machine, both running Linux (which other responders claim is unoptimized). When did you last test?

Also, this might be the speed of the disks at one of the ends - I've never even bothered to check, because making it faster doesn't make a difference for me.