ssh whoami.filippo.io

11

antifuchs 3 years ago | link

This comes with a nice warning about agent forwarding:

                      ***** WARNING ***** WARNING *****

         You have SSH agent forwarding turned (universally?) on. That
        is a VERY BAD idea. For example right now I have access to your
        agent and I can use your keys however I want as long as you are
       connected. I'm a good guy and I won't do anything, but ANY SERVER
        YOU LOG IN TO AND ANYONE WITH ROOT ON THOSE SERVERS CAN LOGIN AS
                                 YOU ANYWHERE.

                       Read more:  http://git.io/vO2A6

3

fcbsd 3 years ago | link

That link was an interesting article on ssh agent forwarding

5

journeysquid 3 years ago | link

Interesting. It says it can’t find me, although I verified it’s the same key I have on GitHub. I assume this is because I upgraded mine to a 4096-bit RSA in the beginning of June (no ed25519 on a released OS X yet) and the data set is older than that.

2

trousers 3 years ago | link

I am also looking forward to ed25519 support in osx. Luckily El Capitan will have a new enough version (openssh 6.7), so it shouldn’t be too long.
1

zg 3 years ago | link

How to upgrade your key to 4096-bit?
1. 3
  
  journeysquid 3 years ago | link
  
  ssh-keygen -b 4096

4

apy 3 years ago | link

So that I understand, the issue here is not one of ‘security’ (as in, I’m not less secure having broadcasted by public key because they are meant to be public) but rather one of anonymity (one can use my public keys to determine who I am)?

4

apg 3 years ago | link

I dont think its an issue, per se (why are you ssh'ing into random, untrusted boxes on the internet?). It is another example of the data we leave behind being usable for the purposes of identification.

Github having an open public key policy is almost no different than any online ad company sharing its “pixel” data with each other in an attempt to sync profiles across all of the networks, to better target you. If you dont give github your name, the key is still a usable fingerprint. Of course if you just have many ssh keys, or utilize a different browser for every website….

2

wally 3 years ago | link

If you want to see what’s going on behind the scenes of an SSH authentication you can use the verbose flags to show more information.

ssh -vvv whoami.filippo.io

From SSH(1):

-v       Verbose mode.  Causes ssh to print debugging messages about its
         progress.  This is helpful in debugging connection, authentica-
         tion, and configuration problems.  Multiple -v options increase
         the verbosity.  The maximum is 3.

2

listrophy 3 years ago | link

OK. Interesting for sure. Now how would I fix this information leak?

For example, is there a way to prevent the ssh-client from sending certain/all public keys when connecting to unknown servers?

3

djm 3 years ago | link

Taken from chrisfosterelli on HN:

If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.
3
listrophy 3 years ago | link
I think I’ve got it. In your ~/.ssh/config, put the following:
```
Host for.every.host.you.have.example.com
  PubkeyAuthentication yes

Host *
  PubkeyAuthentication no
```
These need to be in this particular order because ssh_config grabs the first matching value for keys that it looks up. Basically, you just have to add PubkeyAuthentication yes to each Host entry. Not ideal, but it works.
1. 2
  
  trousers edited 3 years ago | link
  
  Or you could just rename your key to something non-default, like ~/.ssh/mykey.rsa and ~/.ssh/mykey.rsa.pub and then just specify identityfile ~/.ssh/mykey.rsa in each individual host match block.
  
  edit: might need to specify IdentitiesOnly yes in the host * list too though, otherwise all keys in the agent will be tried as well.
  1. 2
    
    antifuchs 3 years ago | link
    
    Confirmed - you definitely do have to specify IdentitiesOnly yes, otherwise the SSH agent will try all the IDs it has loaded.
    
    Fun fact: This option also solves problems if you happen to have many SSH keys on your agent and are logging into a machine (e.g. Ubuntu’s EC2 images) with a maximum number of pubkey auth attempts set: Without it set to yes, you find yourself unable to log in even if you do have the correct private key on your ssh agent.
    1. 1
      
      trousers edited 3 years ago | link
      
      You can also apparently use IdentitiesOnly in conjunction with agent forwarding. This took me some searching to figure out. Place the public key on the remote box, and reference the key in the agent by the public key (instead of private key).
      
      ssh someremotebox ssh-add -L | grep mykey > ~/.ssh/mykey.pub # host someremote # identityfile ~/.ssh/mykey.pub

1

calvin 3 years ago | link

For PuTTY users that also use Pageant, remove this checkbox from default settings. (If you manually set key files per session, you should be fine.)