6 ms·
Devzat – Chat over SSH, with some nice quality-of-life features
- rwmj 2y agoI wonder if you could do something similar with an ssh account which is hard-wired to run 'ytalk' (https://en.wikipedia.org/wiki/Talk_(software) https://en.wikipedia.org/wiki/Talk_(software)).
- codazoda 2y agoProbably. See my comment (and example repo) elsewhere about running any old binary when someone connects.
- Borg3 2y agoOr you can just run IRC client on start. Just trap SIGINT and SIGTSTP, run simple or modified client that cannot do exec or escape to shell and you are done :)
- jagged-chisel 2y agoSpoiler: set the user’s shell to any old binary, like a chat app.
- semi-extrinsic 2y agoOr in the authorized_keys file, prepend the public key with a specified command. This is then the only command that the user can execute when logging in with that particular key. To wit: command="/usr/bin/foo" ssh-ed25519 AAAA....
- titaniumtown 2y agoi had no idea about that, thank you!
- kijin 2y agoI suppose this will also lock the user out of sftp and scp? Because otherwise they might be able to edit the authorized_keys file and run any command.
- fragmede 2y agoI'd recommend using https://github.com/gliderlabs/ssh https://github.com/gliderlabs/ssh instead, no chance of some shell escape that way.
- quackduck 2y agoI use a fork of that!
- yu3zhou4 2y agoThere was a beginner friendly machine to hack on HackTheBox where you had to hack a Devzat instance
- quackduck 2y agoa devzat regular made that!
- styczen 2y agoNormal talk in unices system can do that. Irc have exange data between server and minimalize data trafic. still irc is better, but meybe in future
- Joker_vD 2y agoThere was also `write` [0]. It would literally parse /etc/utmp [1] to find out which terminal the recepient user was logged on, then it would open that terminal and write(2) the message to it. Ah, wonderful user isolation. [0] https://man.cat-v.org/unix-6th/1/write https://man.cat-v.org/unix-6th/1/write [1] https://man.cat-v.org/unix-6th/5/utmp https://man.cat-v.org/unix-6th/5/utmp
- riedel 2y agoI still use posix write [1] if there is an incident and i want to talk to the other admins that all try to fix sth. Quite fünf AS the younger ones are always Quote puzzled and feel caught... [1] https://manpages.org/write https://manpages.org/write
- codazoda 2y agoI experimented with writing a shell replacement a while back. Turns out you can just run any old program. Here’s and example “hello world” shell replacement written in Go. https://github.com/codazoda/goshell https://github.com/codazoda/goshell
- jagged-chisel 2y ago> Turns out you can just run any old program. It’s amazing how simple some things are. Similarly, an HTTP server can also run any old binary in response to an incoming request. As long as it produces output that looks like an HTTP response, the client will receive that response.
- steve1977 2y agogood old cgi
- mro_name 2y agobut nginx or caddy can't run CGIs, they want scalability to the billions. Disclaimer: I build a personal social web server https://seppo.social https://seppo.social like that on top of shared (apache) hosting requiring no root privileges to install and run. Or with a few lines of sh you can turn many cli tools to web services like https://qr.mro.name/ https://qr.mro.name/
- languagehacker 2y agoI'd be curious whether there's any security concerns on this one. Could an attacker craft a message that gets access to execute commands into a client terminal?
- Tepix 2y agoYou may not want the chat server owner to know which public ssh key you are using for privacy reasons. Workaround: Specify another ssh keypair
- freedomben 2y agoYeah, though SSH is already very mature at processing text, so it's a surprisingly good fit for a chat. I would also remember that any machine you SSH from is going to give the server some metadata like IP address, public keys (which aren't useful as creds but can be for tracking). Really fun little project though
- tjoff 2y agoSSH might be, but maybe not your terminal. Which the very least can possibly trick you using escape codes. Also, unless my memory fails me 'cat'ing an untrusted file isn't recommended for security reasons. Additionally you should disable SSH forwarding. Relevant thread from the startup selling coffee over SSH: https://news.ycombinator.com/item?id=40227624 https://news.ycombinator.com/item?id=40227624
- qudat 2y agoThis is not sshd, this is a golang binary that uses the stdlib ssh lib. You would have to either a) figure out how to escape out of a golang binary, or b) if the go code executes shell commands with some user provided text, trying to shell inject something in there.
- cwillu 2y agoOr convince the ssh daemon to pass on terminal escape codes to another user. https://nvd.nist.gov/vuln/detail/CVE-2021-33477 https://nvd.nist.gov/vuln/detail/CVE-2021-33477
- codetrotter 2y agoSee also: ssh-chat by shazow from ~10 years ago written in Go ssh chat.shazow.net The most amazing part is perhaps the fact that this one is still around, 10 years later! Try it yourself and you’ll see :) Discussion at the time: https://news.ycombinator.com/item?id=8743374 https://news.ycombinator.com/item?id=8743374 Source code in GitHub repo here: https://github.com/shazow/ssh-chat https://github.com/shazow/ssh-chat
- quackduck 2y agossh-chat sort of inspired devzat. here's the story: I used to live in dubai at the time and for some odd dns reasons I could never actually join ssh-chat, but it acted as proof that ssh chats are possible, and so I decided to make my own version of it. then I moved to the us and was actually able to use both ssh-chat and devzat.
- codetrotter 2y agoThat’s so cool and nice :D Any idea what we could do to allow all of the people still in Dubai to join chats over ssh too?
- nojs 2y ago> odd dns reasons I would love to hear more about this
- freedomben 2y agoCool, the source code is amazingly readable. Also love the sense of humor :-D such as https://github.com/quackduck/devzat/blob/main/commands.go#L177-L183 https://github.com/quackduck/devzat/blob/main/commands.go#L1...
- knodi 2y agoWhen I read this comment, thought good readability it’s got to be Go
- danslo 2y agoI appear to have crashed the server with "tic 999", sorry guys!
- quackduck 2y agothat wasn't it but yeah lol
- deleted 2y ago[deleted]
- ipsum2 2y agoDoesn't seem to be working, the chat is frozen and I can't type anything.
- nedpat 2y agoThis is actually cool! But unless I'm missing something, what's the difference between this and IRC?
- plussed_reader 2y agoThe in-network effect.
- quackduck 2y agohmm? whats that
- plussed_reader 2y agoThe market force that currently propels whatsapp.
- deleted 2y ago[deleted]
- jasonjayr 2y agoAs a gentle reminder, if you are forwarding your ssh-agent by default, you should connect with: ssh -o 'ForwardAgent no' $host So your secure identities are not exposed to a random ssh server ...
- Aeolun 2y agoForwarding your agent by default (to all hosts!) sounds like a terrible idea.
- deleted 2y ago[deleted]
- qudat 2y agoPretty neat! We implemented something similar with an IRC chat app (senpai) in our SSH app (pico.sh). After the user creates an account, it lets users connect to our public IRC bouncer with a single command (`ssh pico.sh -t chat`). ref: https://pico.sh/irc https://pico.sh/irc
- quackduck 2y agoso sorry for it being down right now. hn hug of death is real
- xyst 2y agoGuess it’s only useful as a toy :)
- quackduck 2y agoI just have a really shit server
- mro_name 2y agowhich is great for human scale! Don't serve billions and burn the planet doing so.
- bjoli 2y agoOr the person never expected more than a couple of hundred concurrent users and dimensioned the container or whatever after that. I once wrote a similar chat, but much much worse in many ways, that could easily handle thousands of concurrent users, but hosted it on a 1mbit residential line. When Slashdot hit it I stood no chance.
- humanperhaps 2y agoDidn't think about that when posting - my bad
- quackduck 2y agooh nonono thanks for posting lol
- humanperhaps 2y agoAmazing project, by the way!
- xyst 2y agoIs this working for anybody else? I created a throwaway ed25519 key, reconfigured ssh config, and tried to connect with ‘ssh chat’ Nothing loads. ‘ssh -v chat’ isn’t helpful either. ping and nc (on both 22 and 443) show the server (or load balancer) is accessible for me. Maybe a “hnfp DoS” (hacker news front page DoS)?
- localfirst 2y agowhat sort of server resource usage is this like right now as you are getting a ton of traffic? also noticed that people were able to run commands but permission denied. that kinda freaked me out. eventually somebody is going to figure out how to escape the go binary
- quackduck 2y agoim not worried at all :)
- tempestlxc 2y agoChatting via SSH has given me a lot of insights. Thank you.
- tcsenpai 2y agoIf you want to use my server, it might be a little more powerful than the current one. I would self host but to be honest I'd prefer helping out with the main instance. In case, I am here
- callwhendone 2y agossh: connect to host devzat.hackclub.com port 22: Connection refused PORT STATE SERVICE 22/tcp closed ssh Nmap done: 1 IP address (1 host up) scanned in 1.18 seconds ---- overloaded?
- 1vuio0pswjnm7 2y agohttps://man.netbsd.org/authpf.8 https://man.netbsd.org/authpf.8 https://man.openbsd.org/authpf https://man.openbsd.org/authpf
- lynx23 2y agoRelated: Does anyone by chance know how to configure an "anonymous" ssh account that always runs the same program? This would be great for making text mode games available to everyone without needing to support different platforms, now that windows actually ships with ssh.
- fragmede 2y agocustomize https://github.com/gliderlabs/ssh https://github.com/gliderlabs/ssh I use it for funky.nondeterministic.computer
- quackduck 2y agoyou can configure sshd to run any random executable when a user connects
- SushiHippie 2y agoWouldn't it be possible to just change the shell via 'chsh' or editing /etc/passwd to point to the text mode game for a particular user
- hiAndrewQuinn 2y agoI have a Raspberry Pi running a read-only server where some friends and I have a "poor man's IRC" chat, in that we all log in from Termux and post messages to one another using `wall`. It's absolutely ridiculous and I love it.
- thejosh 2y agoIt's one of those things that if you need to ask why, you'll never understand :-)
- _joel 2y agoYea, came here to say, what about wall! :)
- deleted 2y ago[deleted]
- complaintdept 2y agoInstall `finger` and you've practically got a social media platform.
- kouru225 2y agoI’m trying to google finger and all I get is fingerprint software
- LawnGnome 2y agohttps://en.wikipedia.org/wiki/Finger_(protocol) https://en.wikipedia.org/wiki/Finger_(protocol) An old, old Internet protocol that was used to get information on a user, and could be used by users to post updates from their .plan files. Essentially plaintext social media for people with Internet connections in the 80s and (early-ish) 90s.
- mercutio2 2y ago
- aa-jv 2y agoThis is great, now we just need a way to host it on our mobile phones.
- Tepix 2y agoLooks like ascii colors aren't being filtered correctly.. which is a pretty big issue. White on white isn't very readable... :-)
- quackduck 2y agothis sounds like a terminal thing. what terminal are you on.
- ingen0s 2y agoThis makes my list for top of the year, nice work.
- sdsd 2y agoI love stuff like this. I made a widget for MacOS where you can see incoming |hi messages sent to your Urbit, as a kind of poor man's p2p chat. But I didn't add a feature to send hi messages, so you still need a CLI for that. You can see what it looks like here: https://www.youtube.com/watch?v=_bAx4Jx39jE&t=384s https://www.youtube.com/watch?v=_bAx4Jx39jE&t=384s (it's the widget in the bottom right of the screen)