10 ms·

Exactly! Once I get the keys I just check them against a scraped database of GitHub keys and ask the API for your name. (And if you have agent forwarding activ

Exactly! Once I get the keys I just check them against a scraped database of GitHub keys and ask the API for your name. (And if you have agent forwarding active I show you a big WARNING [0].) There's an explanation in the README [1] but the actually interesting stuff is in server.go [2]. Finally I mentioned a few reasons it might not work for you below [3]. [0] http://git.io/vOVYm http://git.io/vOVYm [1] https://github.com/FiloSottile/whosthere https://github.com/FiloSottile/whosthere [2] https://github.com/FiloSottile/whosthere/blob/master/src/ssherver/server.go https://github.com/FiloSottile/whosthere/blob/master/src/ssh... [3] https://news.ycombinator.com/item?id=10005169 https://news.ycombinator.com/item?id=10005169

songgao 11y ago
This might be more obvious than I thought, but could you explain how you scraped all of GitHub keys throughout the entire user-base?
- rmetzler 11y ago
  There is a URL for the keys of a user. And phillipo used the dataset benjojo published a few month ago when he scraped all the keys: https://blog.benjojo.co.uk/post/auditing-github-users-keys https://blog.benjojo.co.uk/post/auditing-github-users-keys
jvehent 11y ago
It's a cool awareness experiment. Ultimately, public keys are public and people shouldn't be afraid of sharing them. Agent forwarding sharing is a big one though. Getting people to stop doing that automatically takes a lot of education. https://wiki.mozilla.org/Security/Guidelines/OpenSSH#SSH_agent_forwarding https://wiki.mozilla.org/Security/Guidelines/OpenSSH#SSH_age...
- marcosdumay 11y ago
  The public keys should be ok. But the comment on them may be a problem.
  - kpcyrd 11y ago
    The comment isn't sent to the server during the authentication
JoshTriplett 11y ago
> (And if you have agent forwarding active I show you a big WARNING [0].) It amazes me that people enable that for random servers. Seems like SSH should make that harder. Enabling it for a specific server you trust makes sense; enabling it for all servers doesn't. SSH could reject "ForwardAgent" outside a Host block, for instance, and force you to at least write a "Host *" block. EDIT: Check out this search: https://github.com/search?utf8=%E2%9C%93&q=ForwardAgent&type=Code&ref=searchresults https://github.com/search?utf8=%E2%9C%93&q=ForwardAgent&type...
- skarap 11y ago
  > EDIT: Check out this search: https://github.com/search?utf8=%E2%9C%93&q=ForwardAgent&type.. https://github.com/search?utf8=%E2%9C%93&q=ForwardAgent&type.... Holy mother of god, can we somehow return to the time when almost nobody used *nix and Microsoft was the one struggling to keep systems of these people secure?
  - riffraff 11y ago
    I don't think this time ever existed, I remember some fifteen years ago using google to search for unshadowed /etc/passwd and vulnerable cgi scripts, and there were tons of results.
- phamilton 11y ago
  For those who don't get why this is terrible, imagine if GitHub were compromised and their ssh agent tampered with. When you clone a repo, they could use your forwarded agent to log into your production hosts. That's pretty bad.
  - javajosh 11y ago
    I don't fully understand how this would work - the key being "forwarded agent". My (poor) understanding is that in order for compromised github to get to a host I'm connected to they would somehow need to invoke ssh on my host, somehow. The only way that would not be the case is if ssh maintains an in-memory persistent thing that a) maintains connections to foreign hosts, and b) can somehow be signaled from active connections. If that's true, then a) I didn't realize it could do that, and b) it would be quite handy sometimes, although the security implications are rather serious.
brandonbloom 11y ago
And now I've rotated my keys and fixed my ssh config file. Thanks :-)
- umangd 11y ago
  why rotate them? They're just public keys anyways. Useless on their own.
leni536 11y ago
Note that -X is similarly bad on untrusted servers [1]. While it's an old article, it's still valid. [1] http://www.hackinglinuxexposed.com/articles/20040705.html http://www.hackinglinuxexposed.com/articles/20040705.html
- FiloSottile 11y ago
  Thanks for the link, adding a warning for that, too.
rhino42 11y ago
Thanks for the warning by the way! Moved forwardagent to specific servers. I almost always log into trusted servers, but it's good to be preemptive ;-)

songgao 11y ago

This might be more obvious than I thought, but could you explain how you scraped all of GitHub keys throughout the entire user-base?

rmetzler 11y ago
There is a URL for the keys of a user. And phillipo used the dataset benjojo published a few month ago when he scraped all the keys: https://blog.benjojo.co.uk/post/auditing-github-users-keys https://blog.benjojo.co.uk/post/auditing-github-users-keys

jvehent 11y ago

It's a cool awareness experiment. Ultimately, public keys are public and people shouldn't be afraid of sharing them. Agent forwarding sharing is a big one though. Getting people to stop doing that automatically takes a lot of education. https://wiki.mozilla.org/Security/Guidelines/OpenSSH#SSH_agent_forwarding https://wiki.mozilla.org/Security/Guidelines/OpenSSH#SSH_age...

marcosdumay 11y ago
The public keys should be ok. But the comment on them may be a problem.
- kpcyrd 11y ago
  The comment isn't sent to the server during the authentication

JoshTriplett 11y ago

> (And if you have agent forwarding active I show you a big WARNING [0].) It amazes me that people enable that for random servers. Seems like SSH should make that harder. Enabling it for a specific server you trust makes sense; enabling it for all servers doesn't. SSH could reject "ForwardAgent" outside a Host block, for instance, and force you to at least write a "Host *" block. EDIT: Check out this search: https://github.com/search?utf8=%E2%9C%93&q=ForwardAgent&type=Code&ref=searchresults https://github.com/search?utf8=%E2%9C%93&q=ForwardAgent&type...

skarap 11y ago
> EDIT: Check out this search: https://github.com/search?utf8=%E2%9C%93&q=ForwardAgent&type.. https://github.com/search?utf8=%E2%9C%93&q=ForwardAgent&type.... Holy mother of god, can we somehow return to the time when almost nobody used *nix and Microsoft was the one struggling to keep systems of these people secure?
- riffraff 11y ago
  I don't think this time ever existed, I remember some fifteen years ago using google to search for unshadowed /etc/passwd and vulnerable cgi scripts, and there were tons of results.
phamilton 11y ago
For those who don't get why this is terrible, imagine if GitHub were compromised and their ssh agent tampered with. When you clone a repo, they could use your forwarded agent to log into your production hosts. That's pretty bad.
- javajosh 11y ago
  I don't fully understand how this would work - the key being "forwarded agent". My (poor) understanding is that in order for compromised github to get to a host I'm connected to they would somehow need to invoke ssh on my host, somehow. The only way that would not be the case is if ssh maintains an in-memory persistent thing that a) maintains connections to foreign hosts, and b) can somehow be signaled from active connections. If that's true, then a) I didn't realize it could do that, and b) it would be quite handy sometimes, although the security implications are rather serious.

brandonbloom 11y ago

And now I've rotated my keys and fixed my ssh config file. Thanks :-)

umangd 11y ago
why rotate them? They're just public keys anyways. Useless on their own.

leni536 11y ago

Note that -X is similarly bad on untrusted servers [1]. While it's an old article, it's still valid. [1] http://www.hackinglinuxexposed.com/articles/20040705.html http://www.hackinglinuxexposed.com/articles/20040705.html

FiloSottile 11y ago
Thanks for the link, adding a warning for that, too.

rhino42 11y ago

Thanks for the warning by the way! Moved forwardagent to specific servers. I almost always log into trusted servers, but it's good to be preemptive ;-)