FiloSottile/whoami.filippo.io

Avoiding SSH key enumeration

daenney opened this issue · 6 comments

daenney commented

So for those interested in how to avoid the enumeration of SSH keys. Set globally in your .ssh/config the PreferredAuthentications option to keyboard-interactive,password. That seems to prevent SSH from defaulting to sending your keys over.

Now you'll need a Host stanza for every host that you do want to connect to with a key that includes an IdentityFile setting or pass that in as an option when using SSH to connect to said machine.

FiloSottile commented

Just added some similar instructions to the README.

https://github.com/FiloSottile/whosthere#how-do-i-stop-it

jomo commented

You can also set this in your /etc/ssh_config or ~/.ssh/config:

Host *
  IdentitiesOnly yes # only use the authentication identity files configured in the ssh_config files
  User root          # don't send my local username
vincentbernat commented

IdentitiesOnly only prevents identities stored in an agent to be sent. Other identities, notably ~/.ssh/id_* are still sent.

FiloSottile commented

Daaaamn @vincentbernat is right. Updating the README.

jomo commented

Oh well I had my default IdentityFile set to /dev/null :neckbeard:

daenney commented

Oh well I had my default IdentityFile set to /dev/null :neckbeard:

Ha, I like that one, thanks!