4 ms·

I never quite understand why there’s not a confirm version. ForwardWithConfirmation or something. I’m active when I need forwarding - would be happy to simply b

by aidos 8y ago

I never quite understand why there’s not a confirm version. ForwardWithConfirmation or something. I’m active when I need forwarding - would be happy to simply be prompted before it’s allowed.

Leace 8y ago
If you use Yubikey with touch-to-use enabled that'll be basically what you're asking - each authentication will require touching the token.
- haasted 8y ago
  I just enabled that after seeing this incident. For people in the same boat, it can be done trivially using the YubiKey Manager CLI: https://developers.yubico.com/yubikey-manager/ https://developers.yubico.com/yubikey-manager/
rwmj 8y ago
Some ssh agent implementations do this, notably the one built into Android ConnectBot can be configured to request confirmation each time it is asked to authenticate. Unfortunately ssh-agent (from OpenSSH) does not as far as I know. It's happy to authenticate as many times as requested without any notification.
- DBFFD990 8y ago
  It can, and it's determined per key when added to the agent. Look for -c here: https://man.openbsd.org/ssh-add https://man.openbsd.org/ssh-add
  - rwmj 8y ago
    Indeed it is - I even checked the man page before posting the comment and completely missed that option.
DblPlusUngood 8y ago
OpenSSH does have confirmation: use the '-c' switch to ssh-add. https://man.openbsd.org/ssh-add https://man.openbsd.org/ssh-add
- felipelemos 8y ago
  This could be a sane default.
- aidos 8y ago
  Waaaaaaat?! That could definitely be better known.
  - Arathorn 8y ago
    TIL :|
    - acct1771 8y ago
      Hang in, there.
- e12e 8y ago
  Hm, anything similar for gpg agent (both for gpg, and as a stand-in for ssh-agent)? Ed: looks like I need to edit my sshcontrol-file https://www.gnupg.org/documentation/manuals/gnupg/Agent-Configuration.html https://www.gnupg.org/documentation/manuals/gnupg/Agent-Conf...
- aquabeagle 8y ago
  Or "AddKeysToAgent confirm" in ~/.ssh/config

by aidos 8y ago

I never quite understand why there’s not a confirm version. ForwardWithConfirmation or something. I’m active when I need forwarding - would be happy to simply be prompted before it’s allowed.

Leace 8y ago

If you use Yubikey with touch-to-use enabled that'll be basically what you're asking - each authentication will require touching the token.

haasted 8y ago
I just enabled that after seeing this incident. For people in the same boat, it can be done trivially using the YubiKey Manager CLI: https://developers.yubico.com/yubikey-manager/ https://developers.yubico.com/yubikey-manager/

rwmj 8y ago

Some ssh agent implementations do this, notably the one built into Android ConnectBot can be configured to request confirmation each time it is asked to authenticate. Unfortunately ssh-agent (from OpenSSH) does not as far as I know. It's happy to authenticate as many times as requested without any notification.

DBFFD990 8y ago
It can, and it's determined per key when added to the agent. Look for -c here: https://man.openbsd.org/ssh-add https://man.openbsd.org/ssh-add
- rwmj 8y ago
  Indeed it is - I even checked the man page before posting the comment and completely missed that option.

DblPlusUngood 8y ago

OpenSSH does have confirmation: use the '-c' switch to ssh-add. https://man.openbsd.org/ssh-add https://man.openbsd.org/ssh-add

felipelemos 8y ago
This could be a sane default.
aidos 8y ago
Waaaaaaat?! That could definitely be better known.
- Arathorn 8y ago
  TIL :|
  - acct1771 8y ago
    Hang in, there.
e12e 8y ago
Hm, anything similar for gpg agent (both for gpg, and as a stand-in for ssh-agent)? Ed: looks like I need to edit my sshcontrol-file https://www.gnupg.org/documentation/manuals/gnupg/Agent-Configuration.html https://www.gnupg.org/documentation/manuals/gnupg/Agent-Conf...
aquabeagle 8y ago
Or "AddKeysToAgent confirm" in ~/.ssh/config