Hacker News Reader

> or user-controlled authorised keys and without 2FA and without host key verification. There are trivial browser based local network attacks to gain reverse shell access with such setups.

I'm struggling to see how that attack works without a copy of the private key.

Any pointers for what to search for to understand this better?

View on HN

The key thing here is _user controlled_ private keys: this means that those can leak, and if they leak, you're in trouble.

A better solution is to use ephemeral SSH keys generated using an SSH CA. This kind of thing can be implemented with Hashicorp Vault, though I'm sure there are plenty of other solutions out there.

It simplifies key checking on servers too, as they just need to the details of the signer and there's no need to juggle keys in LDAP.

You'll still need a way to deliver those ephemeral ssh keys to a user controlled location, or make them indirectly usable by users (which amounts to the same thing).

In my company, we have a wrapper around `ssh` that handles that. That's the easy bit.

Reply on news.ycombinator.com