3 ms·
The manual encourages bad SSH practices. The server could collect SSH public keys and use GitHub to resolve them to GitHub users to deanonymize users. To prot
by dolmen 4y ago
The manual encourages bad SSH practices.
The server could collect SSH public keys and use GitHub to resolve them to GitHub users to deanonymize users.
To protect yourself against this kind of problems:
1. Put this block at the end of ~/.ssh/config:
Host *
ForwardAgent no
ForwardX11 no
PermitLocalCommand no
# Avoid keys being propose to any SSH server we connect to (ex: whoami.filippo.io)
PubkeyAuthentication no
IdentitiesOnly yes
AddKeysToAgent no
2. Use a separate private SSH key for each organization you connect to. You must create a config entry to tell OpenSSH to use it. Ex:
Host shhhbb.com
PubkeyAuthentication yes
IdentitiesOnly yes
IdentityFile ~/.ssh/id@shhhbb.com
Disclaimer: I'm the author of https://github.com/dolmen/github-keygen https://github.com/dolmen/github-keygen
- HeckFeck 4y agoAh bollocks, I've been shitposting using my work GH keys. Hopefully I don't get a surprise call from the boss soon.
- bheadmaster 4y agoDon't worry, soon shitposting will be considered "hate speech" and you'll be unable to post anything that is considered inappropriate by surveillance language models' creators.
- zxcvbn4038 4y agoVery nice! Now for the real experience, only one person can use it at a time. ;)
- dolmen 4y agoThis is client side configuration. Not server side.
- dspillett 4y agoFor a little more context and a PoC illustrating the matter: https://github.com/FiloSottile/whoami.filippo.io?ref=words.filippo.io#whoamifilippoio https://github.com/FiloSottile/whoami.filippo.io?ref=words.f...