search

TimothyYe / skm

A simple and powerful SSH keys manager
https://timothyye.github.io/skm
MIT License
954 stars 52 forks source link

Destination constraints #42

Open noonien opened 2 years ago

noonien commented 2 years ago

When connecting to a ssh server, by default, all available public keys are sent for it to choose one for authentication. This is a problem because any server you connect to now has a list of all your public keys. While this is not really a security issue for authentication, it allows servers to identify you if they have, for example, your github ssh key, or check other servers if they accept your public key (see, for example, https://github.com/benjojo/ssh-key-confirmer).

OpenSSH 8.9 implemented detstination constraints, this allows ssh-agent to forwards public keys based on the destination server. The destination constraints can be added via the -h flag to ssh-add.

It would be cool for skm to either support adding destination constraints for keys, or to add keys with destination constraints to .ssh/config

TimothyYe commented 2 years ago

Hi @noonien, thanks for the suggestion.

If this feature is only implemented by OpenSSH starting from version 8.9, I think there is a more flexible way to enable the destination constraints via the Hook Mechanism:

https://github.com/TimothyYe/skm#hook-mechanism

You may put the ssh-add command in the hook script to limit the public keys used to connect to the hosts. When the SSH key is in use, the corresponding hook script will be executed simultaneously.