News for hackers. Stuff that matters.

A comment on Heroku Fucking Console. Parent comment

Re:Heroku Fucking Console by bcoates on Friday March 01, 2013 @12:14PM (#5305495) 

  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
  @         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
  Permissions 0440 for './id_rsa' are too open.
  It is recommended that your private key files are NOT accessible by others.
  This private key will be ignored.
What they think they know about the user and group setup on my machine doesn't give me a lot of confidence in whatever other unsupported assumptions the software probably makes. (and despite saying "recommended" there's no override)

edit: to be clear, this is SSH's "shitdick excuse" not Heroku's.

[ Parent | on HN ]
Re:Heroku Fucking Console by rosser on Friday March 01, 2013 @01:20PM (#5305937)
Maybe I'm weird, but I personally appreciate software that is fundamental to the security of my computing environment being a little paranoid...
[ Parent | on HN ]
Re:Heroku Fucking Console by byroot on Friday March 01, 2013 @12:21PM (#5305548)
Isn't this a warning from ssh not heroku ?
[ Parent | on HN ]
Re:Heroku Fucking Console by ldh on Friday March 01, 2013 @12:35PM (#5305643)
Sibling responses are addressing the general phenomenon in software.
[ Parent | on HN ]
Re:Heroku Fucking Console by ortuna on Friday March 01, 2013 @12:30PM (#5305616)
It is from SSH indeed.
[ Parent | on HN ]
Re:Heroku Fucking Console by xot on Friday March 01, 2013 @08:24PM (#5308021)
Actually, StrictHostKeyChecking=no overrides it, right? and you can stuff that into your ssh config file, if you prefer that over a chmod
[ Parent | on HN ]
Re:Heroku Fucking Console by ams6110 on Saturday March 02, 2013 @12:31PM (#5310224)
No that controls whether you will be allowed to connect to a host when the host key is not the same as the one previously used (mitm detection).
[ Parent | on HN ]
Re:Heroku Fucking Console by bcoates on Friday March 01, 2013 @08:41PM (#5308078)
Doesn't in my version. looks like the behavior is in key_perm_ok in authfile.c and not configurable at all.
[ Parent | on HN ]
Re:Heroku Fucking Console by seryl on Friday March 01, 2013 @12:36PM (#5305650)
chmod 0600 ./id_rsa
[ Parent | on HN ]
Re:Heroku Fucking Console by bcoates on Friday March 01, 2013 @01:06PM (#5305858)
If the file really was already in the badguys group and 0440 it's already been compromised so that's just covering it up. I suppose if SSH really had the courage of its convictions it'd automatically upload the key fingerprint to some revoked key blacklist.
[ Parent | on HN ]
Re:Heroku Fucking Console by acdha on Friday March 01, 2013 @02:34PM (#5306431)
You have the ordering backwards: SSH complains now so the problem is fixed before someone gets limited access to the computer.

If your account or computer has already been compromised you're still screwed but this helps considerably on shared computers, NFS, etc. where the access situation is easier to misunderstand.

[ Parent | on HN ]
Re:Heroku Fucking Console by car54whereareu on Friday March 01, 2013 @01:12PM (#5305893)
blacklist the way sudo does http://xkcd.com/838/
[ Parent | on HN ]
Re:Heroku Fucking Console by vacri on Friday March 01, 2013 @05:22PM (#5307325)
on a fresh debian install, the first user (me) wasn't in the sudoers list. I sudo'd, and got reported. The report mail went to root, which was cloned to the first user...
[ Parent | on HN ]