7 ms·
ssh by default sends all your public keys to a server. Yes you can limit some keys to specific hosts but it's very easy to dox yourself.
by bauruine 6mo ago
ssh by default sends all your public keys to a server. Yes you can limit some keys to specific hosts but it's very easy to dox yourself.
- est 6mo agoso it's good practice to store key in non-default location and use ~/.ssh/config to point the path for each host?
- geocar 6mo agoSpecifically to use a different key for each host.
- 9dev 6mo agoWhat a great case of "you're holding it wrong!" I need to add individual configuration to every host I ever want to connect to before connecting to avoid exposing all public keys on my device? What if I mistype and contact a server not my own by accident? This is just an awfully designed feature, is all.
- est 6mo ago> add individual configuration to every host I ever want to connect Are you AI? You can wildcard match hosts in ssh config. You generally have less than a dozen of keys and it's not that difficult to manage.
- kemotep 6mo agoI have over a dozen ssh keys (one for each service and duplicates for each yubikey) and other than the 1 time I setup .ssh/config it just works. I have the setting to only send that specific host’s identity configured or else I DoS myself with this many keys trying to sign into a computer sitting next to me on my desk through ssh. Like I can’t imagine complaining about adding 5 lines to a config file whenever you set up a new service to ssh onto. And you can effectively copy and paste 90% of those 5 short lines, just needing to edit the hostname and key file locations.
- wasmitnetzen 6mo agoI would say it's best practice to use a key agent backed by a password manager.
- ulrikrasmussen 6mo agoI had never thought about that. Seems like an easy problem to fix by sending salted hashes instead.
- unsnap_biceps 6mo agoThe server matches your purposed public key with one in the authorized keys file. If you don't want to expose your raw public key to the server, you'll need to generate and send the hashed key format into the authorized keys file, which at that point is the same as just generating a new purpose built key, no? Am I missing something?
- grey-area 6mo agoDoesn’t it try one key at a time rather than send all?
- rwmj 6mo agoModern sshd limits the number of retries. I have 5 or 6 keys and end up DoSing myself sometimes.
- grepfru_it 6mo agoThis thread made me realize why fail2ban keeps banning me after one failed password entry :lightbulb:
- unsnap_biceps 6mo agoIt does, and there's typically a maximum number of attempts (MaxAuthTries defaults to 6 IIRC) before the server just rejects the connection attempt.
- 84634E1A607A 6mo agoYep, but this is server-side setting. Were I a sniffer, I would set this to 10000 and now I can correlate keys.
- bauruine 6mo agoTrue but a server that wants to "deanonymize" you can just reject each key till he has all the default keys and the ones you added to your ssh agent. You can try it yourself [0] returns all the keys you send and even shows you your github username if one of the keys is used there. [0] ssh whoami.filippo.io
- grey-area 6mo agoNice, tried it out. This wording is incorrect though: "Did you know that ssh sends all your public keys to any server it tries to authenticate to?" It should be may send, because in the majority of cases it does not in fact send all your public keys.