github-keygen

I recommend 'ssh -o PubkeyAuthentication=no superlogical.jobs` if you have a public key and want to stay anonymous (beyond revealing your IP). Why? Because if you use SSH to connect to connect to GitHub, your SSH public key is published at https://github.com/<username>.keys so an SSH server to which you connect could do a reverse lookup. This is the reason why my ~/.ssh/config has those 2 lines at the end: Host * PubkeyAuthentication no Author of https://github.com/dolmen/github-keygen here.

This is an interesting approach. However the task used as an example just shows how provisionning SSH keys was insecure at that company. In fact the user should generate his private key by himself and just provide the public key to the sysadmin to inject it in the system to grant access. AT NO POINT THE SYSDAMIN SHOULD HAVE A COPY OF THE PRIVATE KEY, even temporary. So the 1Password step shouldn't even be necessary. By the way, I'm the author of github-keygen, a tool to automate the creation of SSH keys dedicated to GitHub access, and to setup SSH settings for that context. https://github.com/dolmen/github-keygen

I have created a tool 12 years ago (still actively maintained) to manage multiple GitHub SSH identities: https://github.com/dolmen/github-keygen

Shameless plug for a tool I developed in order to easily manage GitHub identities for Git access via SSH: https://github.com/dolmen/github-keygen 12 years old, but still actively maintained.

Here are a few use cases for having multiple SSH key per server: - use a different SSH key for each client machine: if the client machine is lost/compromised, just remove that key from the server's authorized_key - multiple accounts for the same server. This is useful for example to use multiple GitHub accounts My github-keygen tool allows to manage your ~/.ssh/config for those GitHub use cases. https://github.com/dolmen/github-keygen

Using an SSH key used with GitHub for other purposes than GitHub is not a good practice (even if it's common). https://github.com/dolmen/github-keygen

I have automated that a long time ago with a more reliable/portable solution: https://github.com/dolmen/github-keygen

See also https://github.com/dolmen/github-keygen

https://github.com/dolmen/github-keygen I'm the author.

Related: my own project to handle SSH keys for GitHub: https://github.com/dolmen/github-keygen The project might not look active, but that's because it just works. 12 years old now.

The manual encourages bad SSH practices. The server could collect SSH public keys and use GitHub to resolve them to GitHub users to deanonymize users. To protect yourself against this kind of problems: 1. Put this block at the end of ~/.ssh/config: Host * ForwardAgent no ForwardX11 no PermitLocalCommand no # Avoid keys being propose to any SSH server we connect to (ex: whoami.filippo.io) PubkeyAuthentication no IdentitiesOnly yes AddKeysToAgent no 2. Use a separate private SSH key for each organization you connect to. You must create a config entry to tell OpenSSH to use it. Ex: Host shhhbb.com PubkeyAuthentication yes IdentitiesOnly yes IdentityFile ~/.ssh/id@shhhbb.com Disclaimer: I'm the author of https://github.com/dolmen/github-keygen

Users of github-keygen [1] might be affected. Please check the public key recorded in ~/.ssh/known_host_github. Note that github-keygen stores the ssh-ed25519 key since release 1.306 in June 2022. You can check by yourself: cat ~/.ssh/known_hosts_github If you are affected, just run github-keygen again to regenerate your SSH configuration: curl --silent https://raw.githubusercontent.com/dolmen/github-keygen/release/github-keygen | perl Disclaimer: I am the author and maintainer of github-keygen [1]: https://github.com/dolmen/github-keygen/

For those who use (or want to use) SSH to connect to GitHub for Git, I wrote 11 years ago a tool to maintain my SSH settings for GitHub. I still actively maintain it. https://github.com/dolmen/github-keygen/ github-keygen features: * automated maintenance of the GitHub specific configuration (just run the latest release of github-keygen and your setup is safely upgraded) * strong security settings * eases the management of your SSH keys allowed to access your GitHub account * performance settings (ControlMaster)

The CPAN modules availability can be worked around using App::FatPacker. https://metacpan.org/pod/App::FatPacker That's what I'm using for github-keygen for maximum portability. https://github.com/dolmen/github-keygen/