Re: SSH host key fingerprint - through HTTPS
W dniu 01.09.2014 o 17:16, Chris Nehren pisze: It's Monday and I haven't had my tea yet, so maybe I'm missing something. What is it? It rules out the possibility, that your ssh connection is being MITMed. If key reported by your ssh client is different than key reported by this website, then you shouldn't bother server admin with it, as the issue is in your network. -- Łukasz Biegaj
Re: SSH host key fingerprint - through HTTPS
If your HTTPS is not being MiTMed as well... (or the edge case - if it is not John Leo doing the MiTMing of your SSH connection :) If you trust Mr Leo *and* you know what that HTTPS cert should look like, it may be of use. Personally, I'd rather do it more out-of-band than this, but could be handy in a pinch I guess. cheers, Jamie On 2 September 2014 07:38, Lukasz Biegaj l.bie...@netshock.pl wrote: W dniu 01.09.2014 o 17:16, Chris Nehren pisze: It's Monday and I haven't had my tea yet, so maybe I'm missing something. What is it? It rules out the possibility, that your ssh connection is being MITMed. If key reported by your ssh client is different than key reported by this website, then you shouldn't bother server admin with it, as the issue is in your network. -- Łukasz Biegaj -- Jamie Riden / ja...@honeynet.org / jamie.ri...@gmail.com http://uk.linkedin.com/in/jamieriden
Re: SSH host key fingerprint - through HTTPS
Thanks. Yes, your suggestion is cool. Best Wishes, On 2014-9-1 19:41, Micha Borrmann wrote: Nice tool, but it is also possible, to use DNSSEC to validate SSH fingerprints, which is much more comfortable and more secure. Am 01.09.2014 um 06:41 schrieb John Leo: This tool displays SSH host key fingerprint - through HTTPS. SSH is about security; host key matters a lot here; and you can know for sure by using this tool. It means you know precisely how to answer this question: The authenticity of host 'blah.blah.blah (10.10.10.10)' can't be established. RSA key fingerprint is a4:d9:a4:d9:a4:d9a4:d9:a4:d9a4:d9a4:d9a4:d9a4:d9a4:d9. Are you sure you want to continue connecting (yes/no)? https://checkssh.com/ We hackers don't want to get hacked. :-) SSH rocks - when host key is right. Enjoy!
Re: SSH host key fingerprint - through HTTPS
Nice tool, but it is also possible, to use DNSSEC to validate SSH fingerprints, which is much more comfortable and more secure. Am 01.09.2014 um 06:41 schrieb John Leo: This tool displays SSH host key fingerprint - through HTTPS. SSH is about security; host key matters a lot here; and you can know for sure by using this tool. It means you know precisely how to answer this question: The authenticity of host 'blah.blah.blah (10.10.10.10)' can't be established. RSA key fingerprint is a4:d9:a4:d9:a4:d9a4:d9:a4:d9a4:d9a4:d9a4:d9a4:d9a4:d9. Are you sure you want to continue connecting (yes/no)? https://checkssh.com/ We hackers don't want to get hacked. :-) SSH rocks - when host key is right. Enjoy! smime.p7s Description: S/MIME Cryptographic Signature
Re: SSH host key fingerprint - through HTTPS
On Mon, Sep 01, 2014 at 12:41:17 +0800, John Leo wrote: This tool displays SSH host key fingerprint - through HTTPS. SSH is about security; host key matters a lot here; and you can know for sure by using this tool. It means you know precisely how to answer this question: The authenticity of host 'blah.blah.blah (10.10.10.10)' can't be established. RSA key fingerprint is a4:d9:a4:d9:a4:d9a4:d9:a4:d9a4:d9a4:d9a4:d9a4:d9a4:d9. Are you sure you want to continue connecting (yes/no)? https://checkssh.com/ Err, let me be sure I understand this tool properly. You have a web service--for which you do not provide the source code--that provides the same information that an ssh client provides. Not providing the source code means that everything from malicious manipulation to bugs are possible and the general public has no means of verification that such do not exist. Beyond that, as said, it provides the same information that the ssh client does, out of band, meaning that it's less convenient and thus less likely to be used. How, then, is this useful? Sure, I can see the value in having another point of presence to validate the ssh key of a server--but ideally, if one cares about the key of a server (which key, by the way? The RSA key? Or maybe the ECDSA? Why not DSA?), one should contact the system administrator over a secure channel *before* connecting and establish the keys over that channel. Lacking source code and control over the server, this service is just as vulnerable to all the attacks that I assume your tool is attempting to mitigate. It's Monday and I haven't had my tea yet, so maybe I'm missing something. What is it? -- Chris Nehren pgpBv2EfswLYL.pgp Description: PGP signature
