ssh whoami.filippo.io

Re:ssh whoami.filippo.io by j1elo on Sunday January 08, 2023 @07:21PM (#34305033)

Just for those curious about it:

  $ ssh whoami.filippo.io

      +---------------------------------------------------------------------+
      |                                                                     |
      |             _o/ Hello!                                              |
      |                                                                     |
      |                                                                     |
      |  Did you know that ssh sends all your public keys to any server     |
      |  it tries to authenticate to? You can see yours echoed below.       |
      |                                                                     |
      |  We tried to use them to lookup your GitHub account,                |
      |  but got no match :(                                                |
      |                                                                     |
      |  -- Filippo (https://filippo.io)                                    |
      |                                                                     |
      |                                                                     |
      |  P.S. The source of this server is at                               |
      |  https://github.com/FiloSottile/whoami.filippo.io                   |
      |                                                                     |
      +---------------------------------------------------------------------+

Of course, this happens because the day I learned about the default behavior of SSH (to send all your keys in hope that one works), I went ahead to disable it to stop remote servers from being able to inspect all my keys. I feel this can be abused in a similar way that sites abuse browser information to fingerprint users. So I put this at the bottom of ~/.ssh/config:

  Host *
      IdentitiesOnly yes

And then I explicitly indicate what key to use for each server, either with the "-i" argument, or adding entries above the previous lines:

  Host example.com
      IdentityFile ~/.ssh/example.com.pem

Other commenter mentioned that something similar can be achieved with "PubkeyAuthentication no", but I've been using "IdentitiesOnly yes" for years without issue.

[ Parent | on HN ]

Re:ssh whoami.filippo.io by yoaquim on Sunday January 08, 2023 @07:30PM (#34305118)

What, if any, are the downsides to this?

Is it just as OP states in article, where you have to interact with the authentication process to provide a key (assuming no key is associated to host as you explain)?

[ Parent | on HN ]

Re:ssh whoami.filippo.io by rjh29 on Sunday January 08, 2023 @07:33PM (#34305148)

The downside is that if you use a large range of servers, you will have to configure them to tell SSH what identies to use. This can be cumbersome if you ssh by alias (e.g. 'foo' rather than 'foo.yourcompany.com').

If you only SSH into servers you trust (a sensible practice) then the benefit is marginal.

[ Parent | on HN ]

Re:ssh whoami.filippo.io by Macha on Sunday January 08, 2023 @08:08PM (#34305450)

Note that it does accept wildcards so you can do rules for *.mycompany.com

You can also use placeholders for keys, so for example I have a ssh config like:

    Host *.mycompany.com
        # Employer specific yubikey stuff
    
    Host *.mydomain.com
        IdentityFile ~/.ssh/keys/id_primary

    Host *
        IdentitiesOnly yes
        IdentityFile ~/.ssh/keys/%r@%h # uses ~/.ssh/keys/[email protected] for github for example

I originally started doing this because I would have so many keys that servers would reject me for too many authentication attempts, but it also helps make it easy to use distinct keys for distinct purposes and avoiding fingerprinting like this*

[ Parent | on HN ]

Re:ssh whoami.filippo.io by jmmv on Monday January 09, 2023 @12:55AM (#34307275)

Additionally, you can also do:

Host foo foo.example.com some.other.alias

[ Parent | on HN ]

Re:ssh whoami.filippo.io by rjh29 on Monday January 09, 2023 @04:01AM (#34308264)

Nice tip about the placeholder, I will steal that. Thanks.

[ Parent | on HN ]

Re:ssh whoami.filippo.io by j1elo on Monday January 09, 2023 @05:43AM (#34308922)

Yes that's exactly what I do. I just left it as an "exercise for the reader" to not make the comment too long :)

This kind of stuff is also useful, for example, for AWS machines:

  Host ec2-*.compute-1.amazonaws.com
      # KeepAlive of 50 seconds, because AWS times out after 60:
      # https://aws.amazon.com/blogs/aws/elb-idle-timeout-control/
      ServerAliveInterval 50

[ Parent | on HN ]

Re:ssh whoami.filippo.io by nextlevelwizard on Monday January 09, 2023 @02:29AM (#34307762)

I am more curious what is the upside?

That you trying to SSH into some random server doesn't know that you also use github?

[ Parent | on HN ]