4 ms·

I feel compelled to be "that guy" for a second and just mention that while this is convenient, it makes you blatantly vulnerable to man-in-the-middle attacks. I

by hnarn 4y ago

I feel compelled to be "that guy" for a second and just mention that while this is convenient, it makes you blatantly vulnerable to man-in-the-middle attacks. I mean, host keys exist for a reason. Sure, for many people security may not "matter" but I still think it's good to be aware when you're doing something that's way out of bounds. I don't know how EC2 instances work in detail, but I imagine there must be a way to get a hold of the host key via an API or something when it's deployed (or maybe at any point) so that integrity could be kept without creating annoyance. I'd be much more comfortable with a solution that, for example, queries AWS over HTTPS before every connection and updates the host key (if necessary).

BrandoElFollito 4y ago
In addition to the security aspect, it helped me understand a few times why I could not ssh into a server by IP. I was in a secure environment, the question for the key appeared, I accepted the new key I sometimes erase known_hosts, change keys etc. so it was not suspicious). And could not log in. It took me some time to realize that the IP I was trying to connect is not mine (as in "at home") but on the company network. I realized that when I recalled that I had the key prompt.
ryan-c 4y ago
> I feel compelled to be "that guy" for a second and just mention that while this is convenient, it makes you blatantly vulnerable to man-in-the-middle attacks. I don't believe that it makes you vulnerable to MitM attacks if you are authenticating with a key.
- deleted 4y ago
  [deleted]
- hnarn 4y ago
  Why?
  - ryan-c 4y ago
    The server requests the client prove it holds the private key in a way that is bound to the session id, which is derived from the shared secret established with ephemeral key exchange. https://security.stackexchange.com/questions/67242/does-public-key-auth-in-ssh-prevent-most-mitm-attacks https://security.stackexchange.com/questions/67242/does-publ...
CGamesPlay 4y ago
Yes! I’m not aware of any aws cli command that gives you the host key of a new instance. I’d definitely use that. The script is designed for ephemeral instances, where I don’t intend to ever connect to the instance again, so saving the host key doesn’t help anything. So, really, anyone not using this hypothetical API is just as vulnerable to such a MITM attack in my threat model.
- LittlePeter 4y ago
  Back in the day `aws ec2 get-console-output --instance-id $ID` used to contain the public key that can be extracted using regex. Not sure if this still works.

by hnarn 4y ago

BrandoElFollito 4y ago

In addition to the security aspect, it helped me understand a few times why I could not ssh into a server by IP. I was in a secure environment, the question for the key appeared, I accepted the new key I sometimes erase known_hosts, change keys etc. so it was not suspicious). And could not log in. It took me some time to realize that the IP I was trying to connect is not mine (as in "at home") but on the company network. I realized that when I recalled that I had the key prompt.

ryan-c 4y ago

> I feel compelled to be "that guy" for a second and just mention that while this is convenient, it makes you blatantly vulnerable to man-in-the-middle attacks. I don't believe that it makes you vulnerable to MitM attacks if you are authenticating with a key.

deleted 4y ago
[deleted]
hnarn 4y ago
Why?
- ryan-c 4y ago
  The server requests the client prove it holds the private key in a way that is bound to the session id, which is derived from the shared secret established with ephemeral key exchange. https://security.stackexchange.com/questions/67242/does-public-key-auth-in-ssh-prevent-most-mitm-attacks https://security.stackexchange.com/questions/67242/does-publ...

CGamesPlay 4y ago

Yes! I’m not aware of any aws cli command that gives you the host key of a new instance. I’d definitely use that. The script is designed for ephemeral instances, where I don’t intend to ever connect to the instance again, so saving the host key doesn’t help anything. So, really, anyone not using this hypothetical API is just as vulnerable to such a MITM attack in my threat model.

LittlePeter 4y ago
Back in the day `aws ec2 get-console-output --instance-id $ID` used to contain the public key that can be extracted using regex. Not sure if this still works.