Hacker News Reader

Comment by cozzyd | Hacker News Reader

I wonder if GitHub is still running a patched openssh...

It's pretty easy to check something kinda close to GitHub's source code to see, if you want.

Just buy a copy of GitHub Enterprise, deobfuscate the files (it's a fun challenge to deobfuscate them, and not all that hard), and look around to see.

It's unfortunately not open source, so we can't share and talk about the code, link to it on GitHub, or anything like that, but if GitHub Enterprise is still using such a patch, it's like the prod github is too.

How do they distribute github enterprise? Like a VM or image?

Publicly downloadable VM images. Choose openstack for a generic qcow image to run with opensource tools. Docker not supported.

https://enterprise.github.com/releases/3.12.1/download

Nice, thanks!

Assuming they wrote an entirely new sshd in ruby or something. Otherwise why should they ship the source code to a patched-up opensshd...

You can see them writing the ssh public keys that are entered into the settings page _somewhere_ in ruby, and you can then kinda guess :)

Well, I'll bet they haven't gone back to "put all the keys in ~/.ssh/authorized_keys" ...

github uses something called babeld (just telnet to github.com port 22; the version string is printed immediately.)

They were using libssh in 2015. (Edit, I did say golang, but after checking it was bitbucket that used golang)

Indeed, the libssh web page lists GitHub as an adopter.

OpenSSH 6.2 from 2013 added AuthorizedKeysCommand, so no patching needed.

The command would still need to print millions of SSH keys on stdout, so this doesn't really help.

I think it takes the user as an argument, so it could relatively nicely solve the problem (though maybe would be too susceptible to DOS attacks since it requires a new process per connection attempt, although openssh should rate limit anyway?)

The SSH username is always "git".

ah, right. I do wonder why they do it that way...

HTTPS URLs are inconvenient for private repositories, and username has to be part of SSH URLs that people share when setting up a submodule or linking to a repository.

> username has to be part of SSH URLs

No? Usernames are optional in SSH URLs.

But then it defaults to the users username on device

Which isn't always in sync with their GitHub username. Which might even be "root".

surely anybody using GitHub via ssh knows how to edit their .ssh/config

Reply on news.ycombinator.com