Show HN: Invite friends to SSH into your laptop using their GitHub handle

Neat.<p>I use the following incantation when authorizing folks to ssh into my servers via github public keys:<p><pre><code> curl https:&#x2F;&#x2F;github.com&#x2F;[github name].keys &gt;&gt; ~&#x2F;.ssh&#x2F;authorized_keys </code></pre> [github name] here should be replaced with github username of your friend or colleague. Really handy because I can just authorize them without a human request&#x2F;response loop and manual key moving. Simple and no external tools needed. Normal caveats about authorizing people apply.

Hey HN - This is basically a hosted version of Teleport[0], which may scare some people. We don&#x27;t store the sessions and you can always self-host if you prefer.<p>[0] <a href="http:&#x2F;&#x2F;gravitational.com&#x2F;teleport&#x2F;" rel="nofollow">http:&#x2F;&#x2F;gravitational.com&#x2F;teleport&#x2F;</a>

Would be neat if having done<p><pre><code> teleconsole -i other_users_github_id </code></pre> my teleconsole session ID would be sent to server along with <i>my</i> Github ID (optionally other user&#x27;s too) so that they could<p><pre><code> teleconsole -j my_github_id </code></pre> to join instead of having to share session ID and fumble around with that.<p>No more&#x2F;less secure that I can see, but it would be more convenient.

I prefer using tmux for this to be a bit more secure. I wrote a blog post about this [0] since it is a bit of a pain in the ass to set up properly. Maybe you should explore this too for your product.<p>[0] <a href="http:&#x2F;&#x2F;joy.pm&#x2F;2015&#x2F;07&#x2F;11&#x2F;pairing_over_tmux.html" rel="nofollow">http:&#x2F;&#x2F;joy.pm&#x2F;2015&#x2F;07&#x2F;11&#x2F;pairing_over_tmux.html</a>

I suppose this is useful if you have two systems both behind NAT...<p>I&#x27;ve run into many situations where I&#x27;m remote and need to SSH into a NATed machine to fix something, and I typically will SSH reverse tunnel to a VPS.<p>From the NATed machine:<p><pre><code> ssh -fN -R52222:localhost:22 user@publichost </code></pre> And then from the public machine:<p><pre><code> ssh user@localhost -p 52222</code></pre>

I&#x27;m confused and have a couple questions:<p>1. Why would I want someone to ssh into my machine -- at least with the frequency that a service to help me do it is valuable?<p>2. How is this easier&#x2F;better than saying &#x27;hey bro whats your ssh pub id? -- eh.. do `cat ~&#x2F;.ssh&#x2F;id_rsa.pub`<p>Over all this seems like a tool that only super technical people would ever use, and for those people adding a key to authorized keys is trivial.

Regarding remote pair programming I haven&#x27;t found a better or faster solution than TMate (<a href="https:&#x2F;&#x2F;tmate.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;tmate.io&#x2F;</a>)<p>If I am feeling paranoid about the user on the other side, I only share just the read-only link, or the web link.

I don&#x27;t have friends that know what SSH is. Just wonderful colleagues.

&gt; ssh-import-I&#x27;d gh:my-gh-name<p>That little command will pull down your GitHub public keys and add them to authorized key file for the user who runs it. Great for setting up new computers. I run it on boot-time for imbedded devices so that I can always access them.

What kind of abuse prevention measures does this have in place? As it stands it looks like a super convenient way to scp garbage into other people&#x27;s computers and I&#x27;m not sure I&#x27;m sold on that.

Another way, using only software that you have already: get your friends&#x27; public keys and make a burner account on any jointly-reachable server&#x2F;laptop&#x2F;whatever and do a follow-the-leader screen:<p><a href="http:&#x2F;&#x2F;blog.endpoint.com&#x2F;2009&#x2F;09&#x2F;gnu-screen-follow-leader.html" rel="nofollow">http:&#x2F;&#x2F;blog.endpoint.com&#x2F;2009&#x2F;09&#x2F;gnu-screen-follow-leader.ht...</a>

Hmm. Seems like all traffic goes through a central proxy server.<p>Shouldn&#x27;t it be possible to use the central server only for hole-punching and implement a TCP-over-UDP connection so that the clients can directly communicate with each other? (And don&#x27;t the major browser vendors already have public NAT-hole-punchers for WebRTC?)

how is<p>&quot;curl <a href="https:&#x2F;&#x2F;www.teleconsole.com&#x2F;get.sh" rel="nofollow">https:&#x2F;&#x2F;www.teleconsole.com&#x2F;get.sh</a> | sh &quot;<p>Still considered even a remotely acceptable method for installation?

You can use SSH keys for VNC, too. Would be neat to see a PoC that allowed you to invite someone to remote control your computer temporarily via their github handle. <a href="https:&#x2F;&#x2F;ubuntuforums.org&#x2F;showthread.php?t=383053" rel="nofollow">https:&#x2F;&#x2F;ubuntuforums.org&#x2F;showthread.php?t=383053</a>

Other than using [tmate](<a href="https:&#x2F;&#x2F;tmate.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;tmate.io&#x2F;</a>), I use some aliases:<p>github-pair (<a href="https:&#x2F;&#x2F;github.com&#x2F;chilicuil&#x2F;shundle-plugins&#x2F;blob&#x2F;master&#x2F;aliazator&#x2F;aliases&#x2F;extra&#x2F;curl.aliases#L4" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;chilicuil&#x2F;shundle-plugins&#x2F;blob&#x2F;master&#x2F;ali...</a>)<p>github-unpair (<a href="https:&#x2F;&#x2F;github.com&#x2F;chilicuil&#x2F;shundle-plugins&#x2F;blob&#x2F;master&#x2F;aliazator&#x2F;aliases&#x2F;extra&#x2F;curl.aliases#L5" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;chilicuil&#x2F;shundle-plugins&#x2F;blob&#x2F;master&#x2F;ali...</a>)<p>Those add &#x2F; remove keys from github to ~&#x2F;.ssh&#x2F;authorized_keys

Are there any advantages to using this instead of exposing port 22 temporarily via ngrok advantages adding your friend public key to authorized_keys? (Which has the added advantage of being pure, unmodified SSH)<p><a href="https:&#x2F;&#x2F;ngrok.com" rel="nofollow">https:&#x2F;&#x2F;ngrok.com</a>

Note to the author: Please don&#x27;t have a command line flag that either means ( a valid local posix path ) or ( a username&#x2F;handle from a specific online service that will be fetched over the network ). *nix cli tools are supposed to be unambiguous. I&#x27;d fork&#x2F;issue&#x2F;patch it, but I don&#x27;t have a need to let people ssh into my any of my boxes. Just posting this here because its a valid learning opportunity that making something &quot;easy&quot; is not always the right choice in a cli tool, and that namespaces are important. What if I have a file named the same as a github user? Which thing will work? Will that behavior change unexpectedly? Best to make them different flags.

Publishing the public key that you use to push to github&#x2F;gitlab is not a big issue... But Re-using your github key-pair, to connect to other unknown and uncontrolled places, _is_ a security issue.<p>Even re-using your daily system user, for this, is a security issue.<p>But if you never did read the sshd_config man page, or never did play with its options, maybe you&#x27;re unaware of this.<p>Also the sshd could be modified at source level.

I&#x27;m guessing the SSH session between me and my friend is not encrypted end-to-end because of proxies and what not in between?

This feature was implemented in tweemux, a lighter wemux-like tool.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;PeopleAdmin&#x2F;tweemux" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;PeopleAdmin&#x2F;tweemux</a><p>It&#x27;s pretty neat.

If you only want to share your shell and not allow anyone to send commands, use <a href="https:&#x2F;&#x2F;shellshare.net&#x2F;" rel="nofollow">https:&#x2F;&#x2F;shellshare.net&#x2F;</a>.

Awesome! I just launched a DevOps consulting company (<a href="https:&#x2F;&#x2F;elasticbyte.net" rel="nofollow">https:&#x2F;&#x2F;elasticbyte.net</a>), and Teleconsole looks like a great option for interactive SSH sessions with clients.

I would be curious to hear anyones feedback on their experience running Teleport in production. I like what I have read on the site and it certainly has some nice features.

So how does the -i parameter know to look in a local file or on github for the public key? Does it look for a &quot;.pub&quot; in the filename? Feels clunky to me.

Reminds me of tmate

Yeah, what a great idea, let random &quot;cloud&quot; services authenticate who gets to login to your machine!