Hacker News Reader

Comment by GauntletWizard | Hacker News Reader

When I was at Google, there was a modified version of ssh-agent, that would simply ask before signing any login request. It popped up a window (x11 or curses, I think regulated by an external program) that asked "Do you want to connect to HOST?"

It seemed such an obvious feature that I was surprised it wasn't part of the standard distribution.

View on HN

No need for a modified agent, just put this in your ~/.ssh/config:

  AddKeysToAgent confirm

You may need to separately install ssh-askpass.

This does not do what parent describes.

It tells the agent to confirm each use of a key using ssh-askpass. The same can be achieved with the -c option for ssh-add.

If the confirmation dialog really also showed a host name then yeah, this is not strictly the same. But it's pretty close.

Blacklisting all connections by default on my own devices and networks.

Native tooling setup guides are easy to find, and software such as PiHole, AdGuard, and Little Snitch (Leaky Snitch btw) make it very manageable... once you get past the first two weeks of manual connection whitelist popups and log crawling hell, that is :)

This article mentions that option and explains why it isn't sufficient.

ssh agent protocol does not carry host information

Yeah, part of this new feature seems to be to add host information to the agent protocol.

Reply on news.ycombinator.com