5 ms·

SSH agent extensions as an arbitrary RPC mechanism

113 points by JNRowe 2y ago

ArchOversight 2y ago
Does the code for this exist somewhere?
- zxcvgm 2y ago
  Doesn't look like it, but the author uses the Go SSH agent library [1] which _does_ have some example code there and looks pretty straightforward, based on what was described in the post. [1] https://pkg.go.dev/golang.org/x/crypto/ssh/agent https://pkg.go.dev/golang.org/x/crypto/ssh/agent
  - hiAndrewQuinn 2y ago
    It is indeed very straightforward. I did a quick check and I use this exact library for my "coarse-grained Debian diff" program, `meikkalainen` [1], and I was able to get it up and working mostly how I wanted within the same morning I started it. Very straightforward, even for a guy who doesn't spend a lot of time in the Goverse. [1]: https://github.com/hiAndrewQuinn/meikkalainen/tree/main https://github.com/hiAndrewQuinn/meikkalainen/tree/main
- mjg59 2y ago
  It does, but unfortunately not somewhere I can point at it yet. I'm working on it.
wiktor-k 2y ago
SSH agent extensions are really powerful. I'm maintaining a crate for writing own agents (and clients) and just recently added an example of providing decryption over extensions [0] which, coupled with the other examples, allows using SSH agent as a proxy between OpenPGP Card devices (eg Yubikeys) and OpenPGP encrypted data. [0]: https://github.com/wiktor-k/ssh-agent-lib/pull/70 https://github.com/wiktor-k/ssh-agent-lib/pull/70 Got some really positive feedback about this one: https://chaos.social/@Foxboron/112416348981479022 https://chaos.social/@Foxboron/112416348981479022 ;) > Windows didn't really do Unix sockets until recently so everything there is awful Sadly the support for Unix sockets on Windows in Rust's standard lib is stuck in a limbo: https://github.com/rust-lang/libs-team/issues/271 https://github.com/rust-lang/libs-team/issues/271 Fortunately the built-in Windows' SSH client and agent work over Named Pipes and it's quite easy to communicate with them that way: https://github.com/wiktor-k/ssh-agent-lib#agent https://github.com/wiktor-k/ssh-agent-lib#agent
- mjg59 2y ago
  Unfortunately the version included in git for Windows doesn't and you have to emulate sockets using magic files instead...
  - Joker_vD 2y ago
    What is so great about Unix sockets that e.g. a normal TCP socket bound to localhost or even a named pipe can not do properly?
    - wiktor-k 2y ago
      The server can get the calling process info [0], which may be useful for local access control. TCP sockets cannot distinguish clients like that. [0]: https://docs.rs/tokio/latest/tokio/net/struct.UnixStream.html#method.peer_cred https://docs.rs/tokio/latest/tokio/net/struct.UnixStream.htm...
    - dijit 2y ago
      UNIX Sockets are more flexible than named pipes; * You can use them for more than two processes communicating (eg. a server process with potentially multiple client processes connecting); * They are bidirectional; * They support passing kernel-verified UID / GID credentials between processes; * They support passing file descriptors between processes; * They support packet and sequenced packet modes. TCP only grants you 2 of these extra features (sequenced packet mode/bidirection), leaving a giant hole in security in the process.
      - Joker_vD 2y ago
        The named pipes, at least on Windows, also support all of that except for passing UID/GID and file handles.
  - wiktor-k 2y ago
    AFAIR you can choose to use Windows OpenSSH or the other one during Git for Windows installation. [0] [0]: https://duckduckgo.com/?q=git+for+Windows+openssh&t=fpas&iax=images&ia=images&iai=https%3A%2F%2Fwww.softwaretestingo.com%2Fwp-content%2Fuploads%2F2022%2F06%2FInstall-GIT-on-Windows-11-OpenSSH.png https://duckduckgo.com/?q=git+for+Windows+openssh&t=fpas&iax...
42wim 2y ago
I've done the same with https://github.com/42wim/ssh-agentx/ https://github.com/42wim/ssh-agentx/ Originally used to sign git commits with pgp in the sshagent, before ssh git commit signing was a thing. Nowadays, I'm using it for signing code remotely on a server with a yubikey on the local laptop. (needs a patched relic - https://github.com/42wim/relic/tree/sshtoken https://github.com/42wim/relic/tree/sshtoken) Also works with windows as it uses https://github.com/buptczq/WinCryptSSHAgent https://github.com/buptczq/WinCryptSSHAgent that did the hard work to get it to talk with almost everything that exists in windows/wsl/putty etc.

113 points by JNRowe 2y ago

ArchOversight 2y ago

Does the code for this exist somewhere?

zxcvgm 2y ago
Doesn't look like it, but the author uses the Go SSH agent library [1] which _does_ have some example code there and looks pretty straightforward, based on what was described in the post. [1] https://pkg.go.dev/golang.org/x/crypto/ssh/agent https://pkg.go.dev/golang.org/x/crypto/ssh/agent
- hiAndrewQuinn 2y ago
  It is indeed very straightforward. I did a quick check and I use this exact library for my "coarse-grained Debian diff" program, `meikkalainen` [1], and I was able to get it up and working mostly how I wanted within the same morning I started it. Very straightforward, even for a guy who doesn't spend a lot of time in the Goverse. [1]: https://github.com/hiAndrewQuinn/meikkalainen/tree/main https://github.com/hiAndrewQuinn/meikkalainen/tree/main
mjg59 2y ago
It does, but unfortunately not somewhere I can point at it yet. I'm working on it.

wiktor-k 2y ago

SSH agent extensions are really powerful. I'm maintaining a crate for writing own agents (and clients) and just recently added an example of providing decryption over extensions [0] which, coupled with the other examples, allows using SSH agent as a proxy between OpenPGP Card devices (eg Yubikeys) and OpenPGP encrypted data. [0]: https://github.com/wiktor-k/ssh-agent-lib/pull/70 https://github.com/wiktor-k/ssh-agent-lib/pull/70 Got some really positive feedback about this one: https://chaos.social/@Foxboron/112416348981479022 https://chaos.social/@Foxboron/112416348981479022 ;) > Windows didn't really do Unix sockets until recently so everything there is awful Sadly the support for Unix sockets on Windows in Rust's standard lib is stuck in a limbo: https://github.com/rust-lang/libs-team/issues/271 https://github.com/rust-lang/libs-team/issues/271 Fortunately the built-in Windows' SSH client and agent work over Named Pipes and it's quite easy to communicate with them that way: https://github.com/wiktor-k/ssh-agent-lib#agent https://github.com/wiktor-k/ssh-agent-lib#agent

mjg59 2y ago
Unfortunately the version included in git for Windows doesn't and you have to emulate sockets using magic files instead...
- Joker_vD 2y ago
  What is so great about Unix sockets that e.g. a normal TCP socket bound to localhost or even a named pipe can not do properly?
  - wiktor-k 2y ago
    The server can get the calling process info [0], which may be useful for local access control. TCP sockets cannot distinguish clients like that. [0]: https://docs.rs/tokio/latest/tokio/net/struct.UnixStream.html#method.peer_cred https://docs.rs/tokio/latest/tokio/net/struct.UnixStream.htm...
  - dijit 2y ago
    UNIX Sockets are more flexible than named pipes; * You can use them for more than two processes communicating (eg. a server process with potentially multiple client processes connecting); * They are bidirectional; * They support passing kernel-verified UID / GID credentials between processes; * They support passing file descriptors between processes; * They support packet and sequenced packet modes. TCP only grants you 2 of these extra features (sequenced packet mode/bidirection), leaving a giant hole in security in the process.
    - Joker_vD 2y ago
      The named pipes, at least on Windows, also support all of that except for passing UID/GID and file handles.
- wiktor-k 2y ago
  AFAIR you can choose to use Windows OpenSSH or the other one during Git for Windows installation. [0] [0]: https://duckduckgo.com/?q=git+for+Windows+openssh&t=fpas&iax=images&ia=images&iai=https%3A%2F%2Fwww.softwaretestingo.com%2Fwp-content%2Fuploads%2F2022%2F06%2FInstall-GIT-on-Windows-11-OpenSSH.png https://duckduckgo.com/?q=git+for+Windows+openssh&t=fpas&iax...

42wim 2y ago

I've done the same with https://github.com/42wim/ssh-agentx/ https://github.com/42wim/ssh-agentx/ Originally used to sign git commits with pgp in the sshagent, before ssh git commit signing was a thing. Nowadays, I'm using it for signing code remotely on a server with a yubikey on the local laptop. (needs a patched relic - https://github.com/42wim/relic/tree/sshtoken https://github.com/42wim/relic/tree/sshtoken) Also works with windows as it uses https://github.com/buptczq/WinCryptSSHAgent https://github.com/buptczq/WinCryptSSHAgent that did the hard work to get it to talk with almost everything that exists in windows/wsl/putty etc.