Re:Keystroke timing obfuscation added to SSH(1)
by 2Gkashmiri on Tuesday August 29, 2023 @02:36PM
(#37311997)
i attempt to use this and some programs recognize this and many just don't
Re:Keystroke timing obfuscation added to SSH(1)
by vladvasiliu on Tuesday August 29, 2023 @05:32PM
(#37314430)
Don't these apps just use PAM? Since the initial complaint was about sudo, I'd figure pam / polkit would handle this, and apps would call those to obtain privilege elevation.
Re:Keystroke timing obfuscation added to SSH(1)
by ptman on Wednesday August 30, 2023 @05:23AM
(#37319428)
Forwarding the ssh agent (-A) is considered insecure. Instead man ssh recommends using a jump host (-J)
Re:Keystroke timing obfuscation added to SSH(1)
by vladvasiliu on Wednesday August 30, 2023 @07:20AM
(#37320334)
I was talking about the GPG agent, so that the key on the smart card can be used to for sudo elevation on the remote host. This usually requires user interaction with the key, so just having access to the agent wouldn't do much. I don't think the ssh agent would help with this.
To your point, I wonder whether that consideration holds when the private key is held on an external device, like is the case with a YubiKey. I use that setup, and I can't add the key to the ssh agent.
$ ssh-add .ssh/id_yubikey_gpg.pub
Error loading key ".ssh/id_yubikey_gpg.pub": error in libcrypto
SSH connections work fine with that key.
Under Windows, you can forward your smartcard over remote desktop. It's one of the few things Windows has I miss on Linux.