[HN Gopher] SSH agent extensions as an arbitrary RPC mechanism
       ___________________________________________________________________
        
       SSH agent extensions as an arbitrary RPC mechanism
        
       Author : JNRowe
       Score  : 41 points
       Date   : 2024-06-13 05:26 UTC (17 hours ago)
        
 (HTM) web link (mjg59.dreamwidth.org)
 (TXT) w3m dump (mjg59.dreamwidth.org)
        
       | ArchOversight wrote:
       | Does the code for this exist somewhere?
        
         | zxcvgm wrote:
         | Doesn't look like it, but the author uses the Go SSH agent
         | library [1] which _does_ have some example code there and looks
         | pretty straightforward, based on what was described in the
         | post.
         | 
         | [1] https://pkg.go.dev/golang.org/x/crypto/ssh/agent
        
       | wiktor-k wrote:
       | SSH agent extensions are really powerful.
       | 
       | I'm maintaining a crate for writing own agents (and clients) and
       | just recently added an example of providing decryption over
       | extensions [0] which, coupled with the other examples, allows
       | using SSH agent as a proxy between OpenPGP Card devices (eg
       | Yubikeys) and OpenPGP encrypted data.
       | 
       | [0]: https://github.com/wiktor-k/ssh-agent-lib/pull/70
       | 
       | Got some really positive feedback about this one:
       | https://chaos.social/@Foxboron/112416348981479022 ;)
       | 
       | > Windows didn't really do Unix sockets until recently so
       | everything there is awful
       | 
       | Sadly the support for Unix sockets on Windows in Rust's standard
       | lib is stuck in a limbo: https://github.com/rust-lang/libs-
       | team/issues/271
       | 
       | Fortunately the built-in Windows' SSH client and agent work over
       | Named Pipes and it's quite easy to communicate with them that
       | way: https://github.com/wiktor-k/ssh-agent-lib#agent
        
       | 42wim wrote:
       | I've done the same with https://github.com/42wim/ssh-agentx/
       | Originally used to sign git commits with pgp in the sshagent,
       | before ssh git commit signing was a thing.
       | 
       | Nowadays, I'm using it for signing code remotely on a server with
       | a yubikey on the local laptop. (needs a patched relic -
       | https://github.com/42wim/relic/tree/sshtoken)
       | 
       | Also works with windows as it uses
       | https://github.com/buptczq/WinCryptSSHAgent that did the hard
       | work to get it to talk with almost everything that exists in
       | windows/wsl/putty etc.
        
       ___________________________________________________________________
       (page generated 2024-06-13 23:00 UTC)