Hacker News Reader

Comment by CGamesPlay | Hacker News Reader

I often SSH into ephemeral servers like autoscaling EC2 instances. The host key checking is unnecessary and annoying, so I use a different SSH command for that:

    function ec2_ssh
      ssh -F ~/.ssh/ec2_config $argv
    end

And then in the ec2_config file…

    StrictHostKeyChecking=no
    UserKnownHostsFile=/dev/null

View on HN

I feel compelled to be "that guy" for a second and just mention that while this is convenient, it makes you blatantly vulnerable to man-in-the-middle attacks. I mean, host keys exist for a reason. Sure, for many people security may not "matter" but I still think it's good to be aware when you're doing something that's way out of bounds.

I don't know how EC2 instances work in detail, but I imagine there must be a way to get a hold of the host key via an API or something when it's deployed (or maybe at any point) so that integrity could be kept without creating annoyance. I'd be much more comfortable with a solution that, for example, queries AWS over HTTPS before every connection and updates the host key (if necessary).

Yes! I’m not aware of any aws cli command that gives you the host key of a new instance. I’d definitely use that.

The script is designed for ephemeral instances, where I don’t intend to ever connect to the instance again, so saving the host key doesn’t help anything. So, really, anyone not using this hypothetical API is just as vulnerable to such a MITM attack in my threat model.

Back in the day `aws ec2 get-console-output --instance-id $ID` used to contain the public key that can be extracted using regex. Not sure if this still works.

In addition to the security aspect, it helped me understand a few times why I could not ssh into a server by IP.

I was in a secure environment, the question for the key appeared, I accepted the new key I sometimes erase known_hosts, change keys etc. so it was not suspicious). And could not log in.

It took me some time to realize that the IP I was trying to connect is not mine (as in "at home") but on the company network. I realized that when I recalled that I had the key prompt.

> I feel compelled to be "that guy" for a second and just mention that while this is convenient, it makes you blatantly vulnerable to man-in-the-middle attacks.

I don't believe that it makes you vulnerable to MitM attacks if you are authenticating with a key.

Why?

The server requests the client prove it holds the private key in a way that is bound to the session id, which is derived from the shared secret established with ephemeral key exchange.

https://security.stackexchange.com/questions/67242/does-publ...

I'd skip the config file:

    function ec2_ssh
      ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null $argv
    end

Reply on news.ycombinator.com