40 ms·

Neat. I use the following incantation when authorizing folks to ssh into my servers via github public keys: curl https://github.com/[github name].keys >>

by aleyan 10y ago

Neat. I use the following incantation when authorizing folks to ssh into my servers via github public keys: curl https://github.com/[github name].keys >> ~/.ssh/authorized_keys [github name] here should be replaced with github username of your friend or colleague. Really handy because I can just authorize them without a human request/response loop and manual key moving. Simple and no external tools needed. Normal caveats about authorizing people apply.

OJFord 10y ago
> https://github.com/[github https://github.com/[github name].keys Didn't know about that, thanks!
- schlowmo 10y ago
  This was the API Ben Cox used to gather more than a million of public keys from (active) Github users to analyze their strength or weakness, which finally led GitHub to revoke the vulnerable/weak keys and notify the users.[0] Edit: Better source. [0] https://blog.benjojo.co.uk/post/auditing-github-users-keys https://blog.benjojo.co.uk/post/auditing-github-users-keys
ezekg 10y ago
Comment of the year.
cderwin 10y ago
I guess it's not a surprise, but apparently gitlab does this too. kudos to both!
a3_nm 10y ago
Of course, caveats about trusting Github also apply. (If Github got hacked, the page https://github.com/[github https://github.com/[github name].keys would serve the public key of a fresh attacker-controlled key and would trigger shortly afterwards an SSH login attempt with that key towards the client IP to do evil stuff.)
- uiri 10y ago
  Not only GitHub but the specific user's account could be compromised through e.g. a weak or reused password. In the general case, you should be fine. Even more so if the person whose GitHub account you are authorizing regularly checks their keys for suspicious activity.
  - ams6110 10y ago
    You can (and should) verify the key fingerprint out of band.
jamiesonbecker 10y ago
That's almost exactly how we (optionally, of course) import your SSH key from Github at Userify.. (well, technically we're using Python requests, not curl, but otherwise exactly the same). The beauty of doing it this way (writing authorized_keys) is that the accounts are completely independent from a third-party auth service. (ok, I guess technically that's what we are, but we're only managing the public keys, and not directly authenticating through a remote server like a directory or database.) SSH has a beautiful design.
andrewguenther 10y ago
This is really the correct way to accomplish what this project is trying to do. No central proxy server that you need to trust and can be trivially done with the commands you already have installed. I would honestly highly recommend against using Teleconsole for those reasons.
- kasbah 10y ago
  Just authorizing ssh login doesn't solve the NAT traversal.
- old-gregg 10y ago
  No it is not. Connecting two machines behind two different NAT'ed networks requires a proxy of some kind, and there's nothing you already "have installed" that would help you. Teleconsole is an instant VPN+SSH in one command and it would be wise to educate yourself on what it does (reading just the 1st sentence of the blog post would be a good start) before recommending anything.
tribaal 10y ago
If you are on an Ubuntu system you can do the same thing with a native utility, try: ssh-import-id-gh <username> It also works with launchpad (of course): ssh-import-id-lp <username> (It does exactly the same but is shorter to type) EDIT: typo
tsuyoshicho 10y ago
or use other https://api.github.com/users/[github https://api.github.com/users/[github username]/keys # JSON

by aleyan 10y ago

OJFord 10y ago

> https://github.com/[github https://github.com/[github name].keys Didn't know about that, thanks!

schlowmo 10y ago
This was the API Ben Cox used to gather more than a million of public keys from (active) Github users to analyze their strength or weakness, which finally led GitHub to revoke the vulnerable/weak keys and notify the users.[0] Edit: Better source. [0] https://blog.benjojo.co.uk/post/auditing-github-users-keys https://blog.benjojo.co.uk/post/auditing-github-users-keys

ezekg 10y ago

Comment of the year.

cderwin 10y ago

I guess it's not a surprise, but apparently gitlab does this too. kudos to both!

a3_nm 10y ago

Of course, caveats about trusting Github also apply. (If Github got hacked, the page https://github.com/[github https://github.com/[github name].keys would serve the public key of a fresh attacker-controlled key and would trigger shortly afterwards an SSH login attempt with that key towards the client IP to do evil stuff.)

uiri 10y ago
Not only GitHub but the specific user's account could be compromised through e.g. a weak or reused password. In the general case, you should be fine. Even more so if the person whose GitHub account you are authorizing regularly checks their keys for suspicious activity.
- ams6110 10y ago
  You can (and should) verify the key fingerprint out of band.

jamiesonbecker 10y ago

That's almost exactly how we (optionally, of course) import your SSH key from Github at Userify.. (well, technically we're using Python requests, not curl, but otherwise exactly the same). The beauty of doing it this way (writing authorized_keys) is that the accounts are completely independent from a third-party auth service. (ok, I guess technically that's what we are, but we're only managing the public keys, and not directly authenticating through a remote server like a directory or database.) SSH has a beautiful design.

andrewguenther 10y ago

This is really the correct way to accomplish what this project is trying to do. No central proxy server that you need to trust and can be trivially done with the commands you already have installed. I would honestly highly recommend against using Teleconsole for those reasons.

kasbah 10y ago
Just authorizing ssh login doesn't solve the NAT traversal.
old-gregg 10y ago
No it is not. Connecting two machines behind two different NAT'ed networks requires a proxy of some kind, and there's nothing you already "have installed" that would help you. Teleconsole is an instant VPN+SSH in one command and it would be wise to educate yourself on what it does (reading just the 1st sentence of the blog post would be a good start) before recommending anything.

tribaal 10y ago

If you are on an Ubuntu system you can do the same thing with a native utility, try: ssh-import-id-gh <username> It also works with launchpad (of course): ssh-import-id-lp <username> (It does exactly the same but is shorter to type) EDIT: typo

tsuyoshicho 10y ago

or use other https://api.github.com/users/[github https://api.github.com/users/[github username]/keys # JSON