Show HN: Keypub.sh – OAuth for the terminal using SSH keys

Sounds like a similar family of problems to [Wish](https://github.com/charmbracelet/wish) by charm.sh. They've been pushing this curious paradigm of "ssh apps", where ssh keys are used to automatically create identities for small self-hosted CLI/TUI apps.

As a useful comment for messh, it looks like you've committed the ssh_server binary file to git; you may want to add that to gitignore, as binary file handling isn't a traditional git strength. I _think_ it's better than it was a decade ago when I last investigated this, but I can see that Pro Git still recommends explicitly setting gitattributes to mark a file as binary https://git-scm.com/book/en/v2/Customizing-Git-Git-Attribute...

theamk · a year ago

Looking at their demos immediately brought back the memories of parsing TUI's using ad-hoc "expect" rules.

I honestly don't get the point of TUIs...

A real command-line interface is extremely useful - it's trivially scriptable, works direct or with ssh, scroll-back buffer logs what happened, commands stay in my shell history, I can copy-paste commands to a friend over chat system, or into shell script, and it's easy for app authors too. Its my first choice for my apps.

If low-color fixed-width character grid is not cutting it, then native app or web app is a great second step, or even intermediate solutions, like generating HTML files from CLI tool and opening them in default browser. You have to invest some effort, but you have infinite ways to design your interface, and it's still in user's familiar environment.

But those charm.sh TUI applications seem utterly useless and highly annoying. They give up all of the terminal advantages: my shell's history is useless, my favorite ways to edit commands does not apply (as they have their own editor), I cannot scroll back and see what the program just printed, I cannot script it, I cannot log it, I cannot search it, I cannot redo the previous action, the color scheme is not the one I've picked... At least with web apps I can parse html and/or hit underlying API directly - no such luck with TUI apps.

At least the good news is that TUI apps are not getting any traction, and I can completely understand why.

PhilippGille · a year ago

> At least the good news is that TUI apps are not getting any traction, and I can completely understand why.

lazygit (54k stars on GitHub) and k9s got a lot of traction and are very popular:

https://github.com/jesseduffield/lazygit

https://github.com/derailed/k9s

skydhash · a year ago

The TUI apps I use regularly are:

* lf (file manager) * vim * htop * moc and ncmpcpp (music) * emacs (which is its own world)

TUI apps are great for one-time actions that needs feedback, especially having a list of something, filtering it, and applying an action on one or more items.

But, I still like to have a CLI version so I can script any reccuring workflow.

darkwater · a year ago

I totally agree with you, I prefer good autocomplete to a TUI for all these reasons (and more). Well, I actually prefer any CLI to a TUI. The most TUI thing I use in my toolkit is `top` (yes, the "classic" one)

houzi · a year ago

TUI's have one thing going for them: Copy paste anything! IntelliJ doesn't let me copy any text it shows me.

Also, TUI's have their place. I haven't looked much at GUI alternatives, but k9s is really great.

Would also assume that interactive apps are simpler to implement if it's a TUI.

Shugyousha · a year ago

> I honestly don't get the point of TUIs...

There are one or two advantages over regular GUIs, but that's it.

The biggest is probably that they are lightweight since there are no GUI library dependencies (and if there are TUI ones, they are usually much lighter than their GUI sisters). This also means there are fewer (if any) dependencies to distribute compared to a GUI.

The only other advantage I can come up with is that a TUI will have to be usable by keyboard only (in almost all cases). This is not a given for regular GUI libraries.

I'm not a fan of TUIs either. I think the only one I am using regularly is `tig` (https://jonas.github.io/tig/). I guess the reason is that I don't have to remember the git revision list syntax that way and that `tig` allows for easy commit searching with `/` ...

ilyagr · a year ago

Another interesting set of ssh apps is https://pico.sh/ . These focus on networking and lightweight hosting (pastes, simple blog), all via ssh or rsync.

akshayKMR · a year ago

Regarding ssh-apps, this seems super duper niche to me even for developers. Like, I get that many devs are terminal savvy, and it's cool that it's possible to serve apps like this but is it practical (to pick for your new product /internal app)?

qudat · a year ago

We are pretty successful over at https://pico.sh using the same techniques — and using wish

latchkey · a year ago

As a bare metal cloud service provider, we built a little TUI app over ssh so that people could upload their public keys to us without having to use a web interface. It has worked out really well because it makes it possible to "upload" the public key without having to do anything but login.

We automatically configure ssh on the servers to auth against our own internal api for serving up the keys. This way, customers can add to authorized_keys and also use our TUI for management as well.

bradgessler · a year ago

I'm working on a different approach that doesn't use ssh at https://terminalwire.com/.

It's meant for inherently server-based CLI's like Github, Stripe, Fly, Heroku, or any other SaaS and can be plugged directly into web frameworks. My thinking is that more companies would ship command-line interfaces if they didn't have to maintain APIs for them, deal with distributing binaries (and all the compatibility issues that come with that), or deal with all the configuration involved in hooking up SSH to their app servers.

It's in beta at the moment, and I'm currently focused on Rails apps to get the ergonomics dialed-in. My goal is to make it possible for people in any web framework to build and ship a CLI to customers in under an hour and never have to touch an API or worry about binary distribution for as long as their CLI exists.

hamandcheese · a year ago

As a developer, I agree. Give me a great CLI, please, not a server rendered TUI.

This gives me another thought though, a "server-rendered" CLI. A tiny shim binary that just sends argv to the server, and the server sends back stdout/stderr. Haven't seen anyone try that.

messh · a year ago

hi, good catch of the binary! (will fix)

`Wish` and also `terminal.shop` were both great sources of inspiration. I hope to see many more ssh apps in the future. I'm already working on the next one

No SSHFP record, TOFU clients. This is not secure.

I wish people would stop trying to use SSH for things like this. PKI has features that are missing here and those features matter.

This is unsafe.

"but raggi, mitm before tofu is a really unrealistic scenario"

ok, well, consider that some large percentage of gas stations in the US have hardware installed to skim your credit cards. those same folks are perfectly well motivated to drop a wifi dns mitm in conference buildings (trivial). new tech conference, handful of credit cards as people gossip about exactly these kinds of things in the hallway track. the roi on these installs would be pretty high, because tech folks tend to have a high credit balance. so yeah, "totally unrealistic" (this is more about terminal.shop, but same principle here as soon as someone uses it for actual value).

filmor · a year ago

- TOFU: Trust on first use (https://en.m.wikipedia.org/wiki/Trust_on_first_use)

- SSHFP: SSH FingerPrint record in the domain name system (https://en.m.wikipedia.org/wiki/SSHFP_record)

- MITM: Man in the middle (https://en.m.wikipedia.org/wiki/Man-in-the-middle_attack)

mathfailure · a year ago

You missed some.

- SSH: Secure SHell (https://en.wikipedia.org/wiki/Secure_Shell)

- PKI: Public Key Infrastructure (https://en.wikipedia.org/wiki/Public_key_infrastructure)

- US: United States (https://en.wikipedia.org/wiki/United_States)

dcow · a year ago

Are you serious? A MITM here cannot sign things with your private key. People who care can add the keypub’s fingerprint before connecting. Adding an sshfp record is completely trivial too. There is no more tofu here than any other ssh connection and the solution is the same. And the added advantage of a PKI means, in a properly designed system, a threat actor can’t do anything useful sitting on the wire. I’m not saying ssh apps are going to take off, just that your reaction is quite hyperbolic.

raggi · a year ago

There’s no separate signing in use here except for the ssh connection, which can be trivially mitm’d in common targeted scenarios because of the lack of webpki and the lack of other preparations. SSHFP would help, but only if configured both in dns, and if the client is both configured to look for it, using secure dns, and the user understands the failure UX and doesn’t just bypass it. On DNS: DoH would help but it is only in widespread use in browsers. DoT would help but it is only in widespread use on android.

In addition to this a further scan of the code reveals it’s also using a btree index lookup for code comparison and no limitation on attempts, so it is likely that this is relatively trivial to attack with timing as well.

Trivialize mitm all you want, you say concerns of mitm are hyperbolic, I gave a practical example of a target rich environment and there are plenty more folks could come up with. SSH may have long been skirting the lack of a better host key distribution system, but this is largely a matter of luck, access and bespoke usage. These new deployments demonstrate a change on two of these factors, increasing risk substantially if this grows.

gwynforthewyn · a year ago

aftbit · a year ago

When you say "OAuth", what exactly do you mean? It looks like this is really just a tool for associating email addresses with SSH keys.

This is an interesting concept, but it smells a bit like a solution in search of a problem. Perhaps it will feel more useful to me once there are two or three SSH apps that I want to access. Even then, I would suggest that prospective SSH app developers just lean on github's public SSH keys instead, as basically all developers will have a github account and this reduces your (already high, relative to webapp) startup friction.

github public ssh keys are not connected to mails. and using the api from the terminal requires installing some tool.

I hope there will be lots of apps for the the terminal, for e.g. cde (cloud dev env) managing, task management, project management, compute as a service, etc.

hnlmorg · a year ago

> using the api from the terminal requires installing some tool.

It really doesn’t. It’s just a HTTP API. So basically anything that can form a TLS connection will work.

But the bigger problem here is that email addresses can be private in GitHub. Also you never know when GitHub might change their API.

wutwutwat · a year ago

``` ).WHERE( AND( table.SSHKeys.Email.EQ(String(to_email)), table.SSHKeys.Fingerprint.EQ(String(fingerprint)), ), ) ```

If not using a `citext` column then you're going to want to normalize (ie downcase/tolower) everywhere you're doing arbitrary string comparisons, or you're going to get incorrect counts.

Also I don't see any null or "" checking taking place before querying...

I'm not going to trust that your service can give me any reasonable confidence about the identity of the ssh key or the email it's attached to.

That aside, I'm not understanding what the goal here is. I've never once needed my ssh key tied to my email address, but if I did, it's included in the public key already...

there is email validation, and the public key is handled between the ssh client and server. If there is no valid public key this code would not even run. The fingerprint is prepared from this valid public key.

Regarding having the email in the ssh pub key: maybe it is there, but it is no validated. Anyone could write anything there

xyst · a year ago

I agree with other commenters that the “oauth” keyword in title is misleading. I assumed this was compliant with oauth spec.

It’s an interesting service, but I doubt I would use this for anything serious beyond toy apps.

There was an article in October mentioning CF acquiring a company that dabbled in this space though. [1]

It’s more for managing authN/Z for internal infra (k8s, servers,) but via existing IdP (with MFA). Underlying tech is “openpubkey”. [2]. I can see this adapted towards authN for CLI apps.

Wanted to test this on my homelab infra but life has gotten in the way.

[1] https://news.ycombinator.com/item?id=41923429

[2] https://github.com/openpubkey/openpubkey

hirsin · a year ago

Oauth usually implies some variability of access - ie selective permissions. Is this more a pure authn layer as opposed to authz?

You have a repo on GitHub... Have you looked at using account public keys for anything? Ie https://github.com/hpsin.keys I hear a lot about how those keys should get used to bootstrap pki systems but I've not seen it happen yet.

Cyphus · a year ago

Ubuntu's installer supports bootstrapping ssh access with this method. Put in your GitHub username and it takes care of the rest. Works for interactive and headless installs.

eichin · a year ago

The `ssh-import-id` package is the basic mechanism for this.

it does have authorization with the `allow` and `deny` commands for granular control of who can can see what. Currently very simple, only for email but maybe other fields in the future

jclulow · a year ago

Care should always be taken when using an SSH client to connect to untrusted hosts. Make sure you’re not actually forwarding your SSH agent to the remote host, or they’ll be able to hijack your keys. Consider also that any output is processed by your terminal, and there have been a number of serious security bugs in terminal escape sequence handling in a variety of terminal emulators in the past.

wkat4242 · a year ago

My yubikey always requires a physical touch so even if the agent is forwarded my keys can't be used. And I'll notice when it tries because I see it flashing.

bityard · a year ago

"Hijack your keys" is somewhat overstating it, all they can do with it is log into other hosts that you can log into, assuming key auth is the only factor. And only while you are connected to the original host.

Terminal security bugs are not more or less serious than your average Chrome 0day.

rfdonnelly · a year ago

Best to use an agent that prompts you for signing. 1Password and Yubikey do this. Are there others?

sneak · a year ago

OAuth means a specific technical thing, and this is not that thing.

rzzzt · a year ago

"X for Y" should make you draw a metaphorical, not literal comparison to X - it is something like X, applied in the context/audience/etc. of Y. "Tinder for boats"¹ is not Tinder.

¹https://www.buzzfeed.com/michellerial/is-your-startup-idea-a...

orblivion · a year ago

Based on current downvotes it seems that people object to this. And I did take this literally myself before going to the comments. Still, I think the metaphorical thing has value as a succinct explainer. Maybe a small change in wording or some quotation marks is the way to go?

benatkin · a year ago

Indeed. It also doesn't have anything like PKCE.