Show HN: Shittp – Volatile Dotfiles over SSH

(github.com)

66 points | by sdovan1 2 hours ago

11 comments

  • sdovan1 2 hours ago
    I often need to login to colleagues' machines at work, but I find that their settings are not what I am familiar with. So I wrote an SSH wrapper in POSIX shell which tars dotfiles into a base64 string, passes it to SSH, and decodes / setups on the remote temp directory. Automatically remove when session ends.

    Supported: .profile, .vimrc, .bashrc, .tmux.conf, etc.

    This idea comes from kyrat[1]; passing files via a base64 string is a really cool approach.

    [1]: https://github.com/fsquillace/kyrat/

  • goku12 1 hour ago
    How about mounting your dotfiles directory (~/.config) or even your entire home directory on the remote system using SSHFS or NFS? I'm sure somebody would have tried it or some project may already exist. Any idea why that isn't as prevalent as copying your dotfiles over?
    • sigwinch 11 minutes ago
      I’m trying to imagine why sshfs mounting the less-capable remote onto the workstation would be blocked.
    • vbernat 31 minutes ago
      This would enable a lot of attacks.
      • Bender 6 minutes ago
        One could make the local side immutable before sharing after ensuring there are no secrets in .config of course.

        Before ssh:

            sudo chattr -R +i ~/.config
        
        After ssh session terminates

            sudo chattr -R -i ~/.config
      • goku12 30 minutes ago
        Could you elaborate?
  • est 11 minutes ago
    I wonder why are dofiles have to be on remote machines?

    e.g. I type an alias, the ssh client expands it on my local machine and send complex commands to remote. Could this be possible?

    I suppose a special shell could make it work.

    • minitech 6 minutes ago
      > I suppose a special shell could make it work.

      Working on it! :)

      Remote machines usually don’t need to know your keystrokes or handle your line editing, either. There’s a lot of latency to cut out, local customization to preserve, and protocol simplification to be had.

  • Y_Y 1 hour ago

      tmp="$(mktemp -d)" && rsync -a --exclude='.ssh' user@host:~/.[!.]* "$tmp"/ && HOME="$tmp" exec "$SHELL"
    • grepfru_it 1 hour ago
      I think this will copy your 9gb Mozilla cache directory as well? Still one liners like this is all you need lol
      • Bender 3 minutes ago
        My mozilla cache would be under ~/.mozilla/firefox. Is the nightly version moving to ~/.config?

        Reason I say would be is I disable disk cache.

      • sigwinch 10 minutes ago
        Any sufficiently-advanced automated rsync would have a filter for caches.
    • imiric 1 hour ago
      I use something similar.

      It's surprising to me how many projects can be replaced with just a line or two of shell script. This project is a slightly more sophisticated shell script that exposes a friendlier UI, but I don't see why it's needed when the alternative is much simpler, considering the target audience.

  • qudat 33 minutes ago
    I have a dotfiles git repo that symlinks my dotfiles. Then I can either pull the repo down on remote machine or rsync. I’m not sure why I would pick this over a git repo with a dotfiles.sh script

    https://erock-git-dotfiles.pgs.sh/tree/main/item/dotfiles.sh...

  • throw2772 22 minutes ago
    This reminds me - in a previous company I worked at, we had a bunch of old firewalls and switches that ran SSH servers without support for modern key exchange algorithms etc

    One of the engineers wrote a shell alias called “shitssh”, which would call ssh with the right options to allow the old crufty crypto algorithms to be used. This alias got passed down to new members of the team like a family heirloom.

  • twp 1 hour ago
    chezmoi has similar functionality, but it does install a binary on the target machine:

    https://www.chezmoi.io/reference/commands/ssh/

  • thunderbong 1 hour ago
    Is this similar to sshrc?

    https://github.com/cdown/sshrc

  • tensegrist 2 hours ago
    time to call the it team at work (on the phone) to ask them to add a new item to the software allowlist
    • grepfru_it 1 hour ago
      Be careful, this will force your defaults over system defaults possibly overriding compliance or security settings. There are a few places I noticed where well-placed malware could hop in etc.

      It’s not bad software, it’s also not mature. I’m currently on a phone and on vacation so this is the extent of my review. Maybe I’ll circle back around with some PRs next week

      • tensegrist 1 hour ago
        i was merely joking about the name apparently being intended to be pronounced in a rather juvenile manner
  • MKWIX8CXX 51 minutes ago
    Bb
  • simmo9000 1 hour ago
    Just wake up and LOL. Good shit!