Room for Charles Duffy and Michael Dorst

Charles Duffy

15:21

Howdy. Opening this re: discussion in stackoverflow.com/questions/56915132/… -- note that I'm at the office right now and half-distracted, so latency may be substantial.

Feeds

Charles Duffy has added Michael Dorst to the list of this room's owners.

Michael Dorst

Hey, thanks.

OpenSSH_7.9p1, LibreSSL 2.7.3
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 48: Applying options for *
debug1: Setting implicit ProxyCommand from ProxyJump: ssh -l michael -v -W '[%h]:%p' optimizer2
debug1: Executing proxy command: exec ssh -l michael -v -W '[athena.ecs.csus.edu]:22' optimizer2
debug1: identity file /Users/michael/.ssh/id_rsa type 0
debug1: identity file /Users/michael/.ssh/id_rsa-cert type -1
debug1: identity file /Users/michael/.ssh/id_dsa type -1

That's the output of ssh -v -o 'ProxyJump michael@optimizer2' [email protected]

Charles Duffy

To be clear, that command is telling it to first connect to optimizer2, and then from there connect to [email protected]. Is that what you want?

Michael Dorst

Oh!

I must have mixed up server1 and server2 in your answer

Charles Duffy

Looks like I actually mixed up which one you meant to be first.

...so that explains that.

(I did imply in the text that server1 was understood to be your eventual destination -- "for all connections to server1" -- but, yeah, that's kinda subtle).

Michael Dorst

15:33

Haha! It's cool. It works now, except that it asks for a password at the second server

Normally it wouldn't do that when sshing from the first to the second, do I need to do an ssh-copy-id from my home computer directly to server2?

Charles Duffy

wait, you have a private key on server1 that server2 accepts? Don't ever do that.

You want to keep your private keys under your control, on your own hardware always.

Michael Dorst

Oh interesting okay

Charles Duffy

(even better is an external device like a smartcard so they can't be stolen off your machine even if you run something trojaned).

Michael Dorst

Huh, I didn't know that was a thing, I'll look it up

Charles Duffy

Personally, I use a YubiKey, but SSH has OpenSC support, so it'll work with just about all standard-compliant smartcards.

anyhow -- in general, if you want to be able to SSH from host1 to host2 and from there to host3 all authenticated with keys that live on your laptop, the way to do that is with SSH agent forwarding.

Michael Dorst

15:36

So how do I do the private key thing directly to server2?

Charles Duffy

just put your laptop's id_rsa.pub in authorized_keys on server2 directly

Michael Dorst

That's what ssh-copy-id does right?

It puts my public key on the server?

Charles Duffy

Think so? I'm old-school; always maintained the files by hand.

Michael Dorst

Oh okay haha

So you just do like an scp to send id_rsa.pub to the remote?

And you would do the same thing for the second (more remote) remote?

Charles Duffy

vi, rather. :)

and yes.

Michael Dorst

15:38

How do you use vi to send a file?

Charles Duffy

(well, vim; I'm not that old-school).

Michael Dorst

Hahaha

Charles Duffy

ssh to the host and use vi to open the destination, then paste?

Michael Dorst

Oh haha

Charles Duffy

...you don't want to scp over the destination, because you can legitimately want more than one key to be accepted

Michael Dorst

15:39

Hang on so, do you paste it into known_hosts?

Charles Duffy

authorized_keys, not known_hosts

Michael Dorst

oh

Charles Duffy

they're different files for different purposes.

Michael Dorst

Out of curiosity, what is known hosts for?

Charles Duffy

authorized_keys == used to authorize the user to the host. known_hosts == used to authenticate the host to the user

if you don't use known_hosts, or, if you just ignore errors and overwrite its current content whenever you're asked, then you're open to man-in-the-middle attacks

someone can pretend to be the host you're trying to connect to

while actually recording everything you're doing (and maybe forwarding the traffic on to the real host).

(similarly, if you're using interactive-password auth, someone doing a MITM can capture your password, though that's a nonissue with RSA keys).

Michael Dorst

15:41

Oh right, that's when you connect to a different computer via the same IP it complains at you and you have to go delete the entry

Charles Duffy

Right. That's so if someone hijacked your connection and put their own system in the middle, you can detect it.

Michael Dorst

Cool. Okay so back to copying id_rsa.pub

I thought that file was in .ssh

But all I have in there is known_hosts

Wait no

Charles Duffy

You only have one if you created one in the first place.

Michael Dorst

authorized_keys

I'm fairly certain I have

Charles Duffy

authorized_keys == the list of id_rsa.pub files allowed to access that account

Michael Dorst

15:42

How could I do public key login without it?

Charles Duffy

that's... a longer discussion.

Michael Dorst

Oh sorry I got confused

Thought I was on my home machine but I was logged into the remote

Charles Duffy

BTW, in general, usage questions about SSH (or UNIX tools in general) are generally a better fit for unix.stackexchange.com

the kind of response they get on StackOverflow is much more variable depending on who sees it first and what mood that person is in, since they're not strictly inside the rules unless the question is narrowly specific to software development.

(if it's something that someone would only run into using SSH in a script, it's generally fine in SO; if it's something someone could run into in interactive command-line usage, not so much).

Michael Dorst

Boom! I added my public key to authorized keys on the second machine, and now I can jump straight there with no password. So now I need to delete the first server's public key from the second server's authorized_keys file?

Okay, I confirmed that I can't log in to the second server from the first without a password. Thanks for your help!

Transcript for

Room for Charles Duffy and Michael Dorst