4 ms·
When I was at Google, there was a modified version of ssh-agent, that would simply ask before signing any login request. It popped up a window (x11 or curses, I
by GauntletWizard 5y ago
When I was at Google, there was a modified version of ssh-agent, that would simply ask before signing any login request. It popped up a window (x11 or curses, I think regulated by an external program) that asked "Do you want to connect to HOST?"
It seemed such an obvious feature that I was surprised it wasn't part of the standard distribution.
- endre 5y agossh agent protocol does not carry host information
- jeltz 5y agoYeah, part of this new feature seems to be to add host information to the agent protocol.
- krono 5y agoBlacklisting all connections by default on my own devices and networks. Native tooling setup guides are easy to find, and software such as PiHole, AdGuard, and Little Snitch (Leaky Snitch btw) make it very manageable... once you get past the first two weeks of manual connection whitelist popups and log crawling hell, that is :)
- metafunctor 5y agoNo need for a modified agent, just put this in your ~/.ssh/config: AddKeysToAgent confirm You may need to separately install ssh-askpass.
- lima 5y agoThis does not do what parent describes.
- metafunctor 5y agoIt tells the agent to confirm each use of a key using ssh-askpass. The same can be achieved with the -c option for ssh-add. If the confirmation dialog really also showed a host name then yeah, this is not strictly the same. But it's pretty close.
- axiolite 5y agoThis article mentions that option and explains why it isn't sufficient.