bdd716e621
This fixes the following vulnerabilities, as reported by govulncheck: Vulnerability #1: GO-2023-2402 Man-in-the-middle attacker can compromise integrity of secure channel in golang.org/x/crypto More info: https://pkg.go.dev/vuln/GO-2023-2402 Module: golang.org/x/crypto Found in: golang.org/x/crypto@v0.0.0-20200420104511-884d27f42877 Fixed in: golang.org/x/crypto@v0.17.0 Example traces found: #1: work/ssh-chat-1.10/sshd/client.go:42:33: sshd.ConnectShell calls ssh.Client.NewSession #2: work/ssh-chat-1.10/sshd/client.go:36:23: sshd.ConnectShell calls ssh.Dial #3: work/ssh-chat-1.10/sshd/net.go:49:2: sshd.SSHListener.handleConn calls ssh.DiscardRequests #4: work/ssh-chat-1.10/sshd/net.go:43:55: sshd.SSHListener.handleConn calls ssh.NewServerConn #5: work/ssh-chat-1.10/sshd/terminal.go:222:13: sshd.Terminal.listen calls ssh.Request.Reply #6: work/ssh-chat-1.10/sshd/client.go:46:2: sshd.ConnectShell calls ssh.Session.Close #7: work/ssh-chat-1.10/sshd/client.go:70:30: sshd.ConnectShell calls ssh.Session.SendRequest #8: work/ssh-chat-1.10/sshd/client.go:65:21: sshd.ConnectShell calls ssh.Session.Shell #9: work/ssh-chat-1.10/cmd/ssh-chat/cmd.go:243:14: ssh.main calls fmt.Fprintln, which eventually calls ssh.channel.Read #10: work/ssh-chat-1.10/sshd/terminal/terminal.go:954:17: terminal.Terminal.SetBracketedPasteMode calls io.WriteString, which calls ssh.channel.Write #11: work/ssh-chat-1.10/cmd/ssh-chat/cmd.go:243:14: ssh.main calls fmt.Fprintln, which eventually calls ssh.extChannel.Read Vulnerability #4: GO-2022-0968 Panic on malformed packets in golang.org/x/crypto/ssh More info: https://pkg.go.dev/vuln/GO-2022-0968 Module: golang.org/x/crypto Found in: golang.org/x/crypto@v0.0.0-20200420104511-884d27f42877 Fixed in: golang.org/x/crypto@v0.0.0-20211202192323-5770296d904e Example traces found: #1: work/ssh-chat-1.10/sshd/client.go:36:23: sshd.ConnectShell calls ssh.Dial #2: work/ssh-chat-1.10/sshd/net.go:43:55: sshd.SSHListener.handleConn calls ssh.NewServerConn Vulnerability #5: GO-2021-0356 Denial of service via crafted Signer in golang.org/x/crypto/ssh More info: https://pkg.go.dev/vuln/GO-2021-0356 Module: golang.org/x/crypto Found in: golang.org/x/crypto@v0.0.0-20200420104511-884d27f42877 Fixed in: golang.org/x/crypto@v0.0.0-20220314234659-1baeb1ce4c0b Example traces found: #1: work/ssh-chat-1.10/cmd/ssh-chat/cmd.go:122:19: ssh.main calls ssh.ServerConfig.AddHostKey Vulnerability #6: GO-2021-0227 Panic on crafted authentication request message in golang.org/x/crypto/ssh More info: https://pkg.go.dev/vuln/GO-2021-0227 Module: golang.org/x/crypto Found in: golang.org/x/crypto@v0.0.0-20200420104511-884d27f42877 Fixed in: golang.org/x/crypto@v0.0.0-20201216223049-8b5274cf687f Example traces found: #1: work/ssh-chat-1.10/sshd/net.go:43:55: sshd.SSHListener.handleConn calls ssh.NewServerConn
ssh-chat
Custom SSH server written in Go. Instead of a shell, you get a chat prompt.
Demo
Join the party:
$ ssh ssh.chat
Please abide by our project's Code of Conduct while participating in chat.
The host's public key is ssh.chat ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKPrQofxXqoz2y9A7NFkkENt6iW8/mvpfes3RY/41Oyt and the fingerprint is SHA256:yoqMXkCysMTBsvhu2yRoMUl+EmZKlvkN+ZKmL3115xU (as of 2021-10-13).
If you see something different, you might be MITM'd.
(Apologies if the server is down, try again shortly.)
Downloading a release
Recent releases include builds for MacOS (darwin/amd64) and Linux (386, amd64, and ARM6 for your RaspberryPi).
Grab the latest binary release here.
Play around with it. Additional deploy examples are here.
Compiling / Developing
Most people just want the latest binary release. If you're sure you want to compile it from source, read on:
You can compile ssh-chat by using make build. The resulting binary is portable and
can be run on any system with a similar OS and CPU arch. Go 1.8 or higher is required to compile.
If you're developing on this repo, there is a handy Makefile that should set
things up with make run.
Additionally, make debug runs the server with an http pprof server. This allows you to open
http://localhost:6060/debug/pprof/ and view profiling data. See
net/http/pprof for more information about pprof.
Quick Start
Usage:
ssh-chat [OPTIONS]
Application Options:
-v, --verbose Show verbose logging.
--version Print version and exit.
-i, --identity= Private key to identify server with. (default: ~/.ssh/id_rsa)
--bind= Host and port to listen on. (default: 0.0.0.0:2022)
--admin= File of public keys who are admins.
--whitelist= Optional file of public keys who are allowed to connect.
--motd= Optional Message of the Day file.
--log= Write chat log to this file.
--pprof= Enable pprof http server for profiling.
Help Options:
-h, --help Show this help message
After doing go get github.com/shazow/ssh-chat/... on this repo, you should be able
to run a command like:
$ ssh-chat --verbose --bind ":22" --identity ~/.ssh/id_dsa
To bind on port 22, you'll need to make sure it's free (move any other ssh daemons to another port) and run ssh-chat as root (or with sudo).
Frequently Asked Questions
The FAQs can be found on the project's Wiki page. Feel free to submit more questions to be answered and added to the page.
License
MIT