4 ms·
I wonder if GitHub is still running a patched openssh...
by cozzyd 3y ago
I wonder if GitHub is still running a patched openssh...
- TheDong 3y agoIt's pretty easy to check something kinda close to GitHub's source code to see, if you want. Just buy a copy of GitHub Enterprise, deobfuscate the files (it's a fun challenge to deobfuscate them, and not all that hard), and look around to see. It's unfortunately not open source, so we can't share and talk about the code, link to it on GitHub, or anything like that, but if GitHub Enterprise is still using such a patch, it's like the prod github is too.
- rudasn 3y agoHow do they distribute github enterprise? Like a VM or image?
- everfrustrated 3y agoPublicly downloadable VM images. Choose openstack for a generic qcow image to run with opensource tools. Docker not supported. https://enterprise.github.com/releases/3.12.1/download https://enterprise.github.com/releases/3.12.1/download
- rudasn 3y agoNice, thanks!
- iforgotpassword 3y agoAssuming they wrote an entirely new sshd in ruby or something. Otherwise why should they ship the source code to a patched-up opensshd...
- TheDong 3y agoYou can see them writing the ssh public keys that are entered into the settings page _somewhere_ in ruby, and you can then kinda guess :)
- jarofgreen 3y agoWell, I'll bet they haven't gone back to "put all the keys in ~/.ssh/authorized_keys" ...
- hanwenn 3y agogithub uses something called babeld (just telnet to github.com port 22; the version string is printed immediately.)
- deleted 3y ago[deleted]
- mkj 3y agoThey were using libssh in 2015. (Edit, I did say golang, but after checking it was bitbucket that used golang)
- cozzyd 3y agoIndeed, the libssh web page lists GitHub as an adopter.
- ptman 3y agoOpenSSH 6.2 from 2013 added AuthorizedKeysCommand, so no patching needed.
- jwilk 3y agoThe command would still need to print millions of SSH keys on stdout, so this doesn't really help.
- cozzyd 3y agoI think it takes the user as an argument, so it could relatively nicely solve the problem (though maybe would be too susceptible to DOS attacks since it requires a new process per connection attempt, although openssh should rate limit anyway?)