SSH agent extensions as an arbitrary RPC mechanism

https://mjg59.dreamwidth.org/69646.html

by JNRowe • 2 years ago

113 16 2 years ago

mjg59.dreamwidth.org

Does the code for this exist somewhere?

zxcvgm• 2 years ago

Doesn't look like it, but the author uses the Go SSH agent library [1] which _does_ have some example code there and looks pretty straightforward, based on what was described in the post.

[1] https://pkg.go.dev/golang.org/x/crypto/ssh/agent

hiAndrewQuinn• 2 years ago

It is indeed very straightforward. I did a quick check and I use this exact library for my "coarse-grained Debian diff" program, `meikkalainen` [1], and I was able to get it up and working mostly how I wanted within the same morning I started it. Very straightforward, even for a guy who doesn't spend a lot of time in the Goverse.

[1] https://github.com/hiAndrewQuinn/meikkalainen/tree/main

mjg593• 2 years ago

It does, but unfortunately not somewhere I can point at it yet. I'm working on it.

wiktor-k4• 2 years ago

SSH agent extensions are really powerful.

I'm maintaining a crate for writing own agents (and clients) and just recently added an example of providing decryption over extensions [0] which, coupled with the other examples, allows using SSH agent as a proxy between OpenPGP Card devices (eg Yubikeys) and OpenPGP encrypted data.

[0] https://github.com/wiktor-k/ssh-agent-lib/pull/70

Got some really positive feedback about this one: https://chaos.social/@Foxboron/112416348981479022 ;)

Windows didn't really do Unix sockets until recently so everything there is awful

Sadly the support for Unix sockets on Windows in Rust's standard lib is stuck in a limbo: https://github.com/rust-lang/libs-team/issues/271

Fortunately the built-in Windows' SSH client and agent work over Named Pipes and it's quite easy to communicate with them that way: https://github.com/wiktor-k/ssh-agent-lib#agent

mjg593• 2 years ago

Unfortunately the version included in git for Windows doesn't and you have to emulate sockets using magic files instead...

Joker_vD2• 2 years ago

What is so great about Unix sockets that e.g. a normal TCP socket bound to localhost or even a named pipe can not do properly?

wiktor-k4• 2 years ago

AFAIR you can choose to use Windows OpenSSH or the other one during Git for Windows installation. [0]

[0] https://duckduckgo.com/?q=git+for+Windows+openssh&t=fpas&iax...

ThePowerOfFuet• 2 years ago

How hard would that be to extend that to include PKCS#11?

wiktor-k4• 2 years ago

The SSH agent shipped with OpenSSH already includes PKCS#11 support (check out the `-s` flag). I'm using that daily to work with TPM-backed keys.

42wim• 2 years ago

I've done the same with https://github.com/42wim/ssh-agentx/ Originally used to sign git commits with pgp in the sshagent, before ssh git commit signing was a thing.

Nowadays, I'm using it for signing code remotely on a server with a yubikey on the local laptop. (needs a patched relic - https://github.com/42wim/relic/tree/sshtoken)

Also works with windows as it uses https://github.com/buptczq/WinCryptSSHAgent that did the hard work to get it to talk with almost everything that exists in windows/wsl/putty etc.

SSH agent extensions as an arbitrary RPC mechanism

Related Stories