I made a thing!
Here’s the scenario: you have some files on your work-computer - let’s say, paystubs, that include your SSN - that you want to get onto your personal computer. This certainly isn’t the kind of thing you want to send over email.
AirDrop? No go: turns out your workplace’s, um, “security” settings block that.
SMB? That requires authenticating with your personal computer, from your work computer. I don’t know about you, but I don’t love the idea of entering credentials on my work machine. I want to make sure that even if there are keyloggers, MITM proxies, etc., installed on my work machine, there are no credentials they could harvest that would grant them access to my own machine when I don’t want it granted.
(You could open a purely-public SMB write-only share on your macOS machine, but, lol, don’t do that.)
The same applies, at first glance, to SSH/SCP. If you have to enter a password, then it’s no different from authentication through SMB as far as the vulnerability to keyloggers etc.; and if you keep private-keys on your work-machine’s hard drive, they are accessible to anyone with admin access to that machine. (And if the private-keys are passphrase-protected, well, you’re entering that passphrase on your work computer, which brings you back to the exact same interception problem.)
This is precisely why folks found ways to combine second-factor TOTP (temporary one-time password) authentication with SSH.
But do you really want to have to type a TOTP every time you SSH from one of your machines to another, even if your work machine is not involved?
I sure don’t.
So I made Concourse.
It offers selective SSH second-factor TOTP, depending on where you’re logging in from. You can configure IP- or CIDR-based rules determining whether the user attempting to SSH (or SCP) will be asked for a TOTP (alongside their regular password or public-key based authentication, of course).
Because the IP/CIDR rules are evaluated in order, you can define a special rule requiring TOTP for the LAN IP of your work machine, followed by a rule that exempts every (other) machine on your LAN subnet from needing a TOTP at all 😎
Much, much information available here.
DISCLAIMER:
Concourse is open-source - released under Apache License 2.0 - but it has not been subjected to any kind of security audit (by human or by LLM).
Use at your own risk!