Re: Pcompletion for ssh and scp

[Phil Hagelberg]

Stefan Monnier <address@hidden> writes:

> All my known_hosts files have "hostnames" that are encoded in the
> following way:
>
>    |1|bXOTR5GrVkVH4ABavbfZ7f2G0EQ=|drXHp56kwVXBTdc/f92649SXiTw=
>
> I don't know how widespread this is, but I haven't made anything special
> to get them: I'm using the standard Debian package without any special
> configuation in this respect, so for your feature to be useful I think
> it needs to handle this case.

Yeah, I mentioned this in the header of the file but forgot to include a
note in my email:

;;; Commentary:

;; This will allow eshell to autocomplete SSH hosts from the list of
;; known hosts in your ~/.ssh/known_hosts file. Note that newer
;; versions of ssh hash the hosts by default to prevent Island-hopping
;; SSH attacks. (https://itso.iu.edu/Hashing_the_OpenSSH_known__hosts_File)
;; You can disable this by putting the following line in your ~/.ssh/config
;; file following the "Host *" directive:

;; HashKnownHosts no

;; Note that this will make you vulnerable to the Island-hopping
;; attack described in the link above if you allow key-based
;; passwordless logins and your account is compromised.

I don't think there's any way to "handle this case" other than making
the user turn off the "hash all hostnames" feature since it is meant to
be one-way to prevent island-hopping attacks. I would like to remove
hashed entries, but I'm not sure if there's a reliable programmatic way
to distinguish them from actual hostnames. I suppose it could assume
that any entry over a certain length is likely to be garbage, but I'd
rather not do that if there's a better way. Any suggestions?

It's a simple fix, but it requires user intervention. I think recent
Debians and derivatives hash by default; not sure what else does.

-Phil