Re:SSH agent extensions as an arbitrary RPC mechanism
by mjg59 on Thursday June 13, 2024 @08:06PM
(#40676247)
Unfortunately the version included in git for Windows doesn't and you have to emulate sockets using magic files instead...
Re:SSH agent extensions as an arbitrary RPC mechanism
by Joker_vD on Thursday June 13, 2024 @10:39PM
(#40677057)
What is so great about Unix sockets that e.g. a normal TCP socket bound to localhost or even a named pipe can not do properly?
Re:SSH agent extensions as an arbitrary RPC mechanism
by wiktor-k on Friday June 14, 2024 @12:55AM
(#40677590)
The server can get the calling process info [0], which may be useful for local access control. TCP sockets cannot distinguish clients like that.
[0]: https://docs.rs/tokio/latest/tokio/net/struct.UnixStream.htm...
Re:SSH agent extensions as an arbitrary RPC mechanism
by dijit on Friday June 14, 2024 @05:13AM
(#40679054)
UNIX Sockets are more flexible than named pipes;
* You can use them for more than two processes communicating (eg. a server process with potentially multiple client processes connecting);
* They are bidirectional;
* They support passing kernel-verified UID / GID credentials between processes;
* They support passing file descriptors between processes;
* They support packet and sequenced packet modes.
TCP only grants you 2 of these extra features (sequenced packet mode/bidirection), leaving a giant hole in security in the process.
Re:SSH agent extensions as an arbitrary RPC mechanism
by Joker_vD on Friday June 14, 2024 @07:51AM
(#40679920)
The named pipes, at least on Windows, also support all of that except for passing UID/GID and file handles.
Re:SSH agent extensions as an arbitrary RPC mechanism
by wiktor-k on Friday June 14, 2024 @12:49AM
(#40677568)
AFAIR you can choose to use Windows OpenSSH or the other one during Git for Windows installation. [0]
[0]: https://duckduckgo.com/?q=git+for+Windows+openssh&t=fpas&iax...
Re:SSH agent extensions as an arbitrary RPC mechanism
by mjg59 on Friday June 14, 2024 @02:00AM
(#40677933)
Unfortunately it's difficult to enforce that, so dealing with users who've already set things up in a specific way is a problem
Re:SSH agent extensions as an arbitrary RPC mechanism
by sambazi on Friday June 14, 2024 @03:02AM
(#40678267)
could always ship a static linked ssh_client
Re:SSH agent extensions as an arbitrary RPC mechanism
by ThePowerOfFuet on Friday June 14, 2024 @10:11AM
(#40681097)
How hard would that be to extend that to include PKCS#11?
I'm maintaining a crate for writing own agents (and clients) and just recently added an example of providing decryption over extensions [0] which, coupled with the other examples, allows using SSH agent as a proxy between OpenPGP Card devices (eg Yubikeys) and OpenPGP encrypted data.
[0]: https://github.com/wiktor-k/ssh-agent-lib/pull/70
Got some really positive feedback about this one: https://chaos.social/@Foxboron/112416348981479022 ;)
> Windows didn't really do Unix sockets until recently so everything there is awful
Sadly the support for Unix sockets on Windows in Rust's standard lib is stuck in a limbo: https://github.com/rust-lang/libs-team/issues/271
Fortunately the built-in Windows' SSH client and agent work over Named Pipes and it's quite easy to communicate with them that way: https://github.com/wiktor-k/ssh-agent-lib#agent