Auth · XB Field Notes

Basic auth carries a reusable credential

Thu, 11 Feb 2027 00:00:00 +0000

HTTP Basic authentication places an encoded username and password in an Authorization header. The encoding is reversible, so possession of that header can be equivalent to possession of the credential. Basic defines a challenge-response exchange, but it does not cryptographically bind a response to a fresh server nonce. A captured accepted value can be replayed while the server continues to accept that account and credential.

Understand the actual exchange

A server can reply with 401 and a WWW-Authenticate: Basic challenge naming a realm. The client may then retry with an Authorization header. A client can also send credentials preemptively within an appropriate protection space. This means authenticated requests carry the credential; it does not mean every initial request must already contain it. The realm helps identify the protection space, rather than granting permissions to every path with a similar label.

The encoded input joins the user identifier, a colon, and the password. The first colon is the separator, so a username cannot contain one while a password can. Base64 is neither encryption nor password hashing. For non-ASCII credentials, character encoding matters: RFC 7617 leaves the default encoding unspecified within ASCII-compatible constraints and allows the challenge to indicate UTF-8. An ASCII demonstration does not validate every internationalized credential path.

Basic itself does not specify a session token or a logout protocol. An application may impose account expiry, disable an account, change authorization, or reject an old password. Therefore password rotation is not the only way to stop acceptance of a captured header. Define revocation and credential lifetime in the server’s actual account policy rather than assuming the wire scheme supplies them.

When it breaks

On an unprotected network path, an observer who reads the header can decode and reuse it. HTTPS with proper certificate validation protects transit to the TLS endpoint. It does not hide the credential from that endpoint, an authorized terminating proxy, or a careless application log. Protect subsequent hops and exclude Authorization values from routine traces, reports, and shared diagnostic captures.

Credentials with broad privileges magnify a leak. Use accounts appropriate to the task and its lifetime, and apply authorization after authentication. A valid credential does not imply permission to perform every operation. A realm label is not a tenant isolation mechanism. Restrict where a client sends credentials, particularly across redirects or when a script reuses a global header for unrelated destinations.

Repeated 401 responses can reflect missing, incorrect, expired, or unsupported credentials. In this example, 403 means the recognized demo account lacks the requested permission, but the general status does not prove that authentication succeeded in every implementation. Check the service’s contract and response challenge rather than inferring the entire identity state from one code.

Check it quickly

Save this as basic-auth.py and run python3 basic-auth.py. All credentials are deliberately synthetic: the username is DEMO and the password is NOT:A:SECRET. The server binds only to loopback and uses plain HTTP to make the protocol mechanics inspectable. Do not replace the demonstration values with real credentials. No TLS, persistent account store, or production authentication service is tested.

from base64 import b64decode, b64encode
from http.client import HTTPConnection
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from threading import Thread
import hmac
import json

synthetic = b'DEMO:NOT:A:SECRET'
authorization = 'Basic ' + b64encode(synthetic).decode('ascii')


class Handler(BaseHTTPRequestHandler):
 def do_GET(self):
 accepted = hmac.compare_digest(self.headers.get('Authorization', '').encode('latin1'),
 authorization.encode('ascii'))
 status = 401 if not accepted else 403 if self.path == '/admin' else 200
 data = {401: b'credentials required\n', 403: b'permission denied\n', 200: b'allowed\n'}[status]
 self.send_response(status)
 if status == 401:
 self.send_header('WWW-Authenticate', 'Basic realm="local-demo", charset="UTF-8"')
 self.send_header('Cache-Control', 'no-store')
 self.send_header('Content-Length', str(len(data)))
 self.end_headers()
 self.wfile.write(data)

 def log_message(self, *args):
 pass


server = ThreadingHTTPServer(('127.0.0.1', 0), Handler)
thread = Thread(target=server.serve_forever)
thread.start()
try:
 observed = []
 for path, credential in [('/', None), ('/', authorization), ('/', authorization),
 ('/admin', authorization), ('/', 'Basic invalid')]:
 connection = HTTPConnection('127.0.0.1', server.server_port, timeout=5)
 try:
 connection.request('GET', path, headers={'Authorization': credential} if credential else {})
 response = connection.getresponse()
 observed.append({'status': response.status,
 'challenge': response.getheader('WWW-Authenticate'),
 'body': response.read().decode()})
 finally:
 connection.close()
 assert [r['status'] for r in observed] == [401, 200, 200, 403, 401]
 assert observed[0]['challenge'] == 'Basic realm="local-demo", charset="UTF-8"'
 user, password = b64decode(authorization.split()[1], validate=True).split(b':', 1)
 assert user == b'DEMO' and password == b'NOT:A:SECRET'
 print(json.dumps({'responses': observed, 'synthetic_decoded_user': user.decode(),
 'synthetic_decoded_password': password.decode(), 'replay_accepted': True}))
finally:
 server.shutdown()
 thread.join()
 server.server_close()

The first request receives 401 with the Basic challenge. Two subsequent requests with the same encoded value both receive 200, demonstrating replay while that credential remains accepted. The demo account receives 403 for /admin, and an invalid header receives another 401. No server log records request headers.

The final assertions decode the synthetic value and split it at the first colon. The remaining colons belong to the password. This verifies reversible encoding, challenge delivery, repeated acceptance, and a separate permission decision. The handler recognizes one fixed demonstration value; it is not a complete authentication implementation. A production review must still examine credential storage, throttling, revocation, transport, and authorization together.

Sources

RFC 7617: Basic authentication, challenge, encoding, credential reuse, and protection spaces, checked 2026-09-13.
MDN: HTTP authentication, authentication headers and transport considerations, checked 2026-09-13.

SSH key hygiene is mostly limiting where a key works

Mon, 06 Jul 2026 00:00:00 +0000

SSH keys are convenient, and convenience is exactly why they get out of hand. The practical discipline is not to generate fewer keys; it is to make each key a named identity with a clear scope, a short lifetime, and a record in the files that tell an auditor who is allowed to do what.

A key should read as an identity

An SSH key should read as an identity, not as a passwordless convenience. Name it for the owner and purpose rather than the laptop it happens to sit on, set a short comment, and put a passphrase on the private key where the toolchain supports it, so possession of the file alone is not enough. A key whose name tells you whom it belongs to and what it exists for lets a future operator apply least privilege without guessing, which is the difference between a scoped credential and an anonymous key graveyard.

Scope is the point

Scope is the real point of a key. Prefer a key that can reach only what the role needs: on the server, restrict which keys are accepted and what each may do through the account and the authorized_keys options, pinning shell or command access; for automation, pin the commands or the working directory it may run in. A compromised key is then contained by its scope rather than being a master key, so the damage stays where the key was allowed to act.

Rotation and the audit trail

Old keys never disappear by themselves, so rotation is what keeps the list honest. Remove keys whose operators have moved on, reissue with a shorter lifetime, and periodically confirm that every accepted key still matches an intended human or automaton and its intended scope. The authorized_keys file is the concrete, verifiable expression of that policy, and a scheduled review of it is cheap insurance, since an outdated key rarely announces itself and a bad one never knocks.

When it breaks

A passphrase-less private key turns every copy into a login. Cloned laptops, shared dotfiles, and cloud backups all carry ~/.ssh; anyone reading such a copy authenticates immediately, indistinguishable from the owner in the server log. No prompt ever fires, so the failure stays silent until an unfamiliar address appears.

Stale authorized_keys entries fail just as quietly. Engineers leave and cron jobs retire, yet the public key stays because nobody owns the cleanup. Months later that forgotten line is still valid, usually with no from= or command= bounding it. Rotation that only adds keys widens the attack surface every cycle.

Legacy algorithms are the third failure. ssh-dss and short ssh-rsa still authenticate against lenient servers, though guidance moved to Ed25519 long ago. Success pages nobody, while each captured handshake gives an attacker more leverage over the weaker primitive. Generate a modern key and delete the old line instead of keeping both.

The fourth is agent forwarding hijack. ssh -A exposes the local agent socket on the remote host, and anyone privileged there can ask it to sign challenges while the session lives. The key file never moves, yet logins fan out as the owner. The symptom is lateral movement with no stolen-key artifact, only signatures from the open forwarding.

Check it quickly

Save the following as ssh_audit.py and run python3 ssh_audit.py. It uses only the standard library, reads the current user’s ~/.ssh, and changes nothing. Hosts without SSH material report SKIP, so it runs cleanly on fresh machines.

"""Audit local SSH key hygiene: permissions, authorized_keys options, algorithms.

Read-only. Uses only the Python standard library.
Missing files are reported as SKIP, not failures.
"""

from __future__ import annotations

import stat
from pathlib import Path

WEAK_KEY_TYPES = {"ssh-rsa", "ssh-dss"}
KNOWN_KEY_TYPES = {
 "ssh-rsa",
 "ssh-dss",
 "ecdsa-sha2-nistp256",
 "ecdsa-sha2-nistp384",
 "ecdsa-sha2-nistp521",
 "ssh-ed25519",
 "sk-ssh-ed25519@openssh.com",
 "sk-ecdsa-sha2-nistp256@openssh.com",
}
RESTRICTING_OPTIONS = (
 "command=",
 "from=",
 "restrict",
 "principals=",
 "no-agent-forwarding",
)
# Files in ~/.ssh that are never private keys.
SKIP_NAMES = {
 "known_hosts",
 "known_hosts.old",
 "config",
 "authorized_keys",
 "environment",
}


def mode_of(path: Path) -> str:
 return oct(stat.S_IMODE(path.stat().st_mode))


def split_options(field: str) -> list[str]:
 """Split an authorized_keys option field on commas outside quotes."""
 options, current, quoted = [], [], False
 for char in field:
 if char == '"':
 quoted = not quoted
 current.append(char)
 elif char == "," and not quoted:
 options.append("".join(current))
 current = []
 else:
 current.append(char)
 if current:
 options.append("".join(current))
 return options


def parse_authorized_key(line: str, lineno: int) -> dict:
 parts = line.split()
 if parts[0] in KNOWN_KEY_TYPES:
 keytype, options = parts[0], []
 else:
 options = split_options(parts[0])
 keytype = parts[1] if len(parts) > 1 else "<unparsable>"
 restricted = any(
 opt.strip().lower().startswith(RESTRICTING_OPTIONS) for opt in options
 )
 return {"lineno": lineno, "type": keytype, "restricted": restricted}


def main() -> int:
 ssh_dir = Path.home() / ".ssh"
 warnings = 0
 checked_keys = 0
 if not ssh_dir.is_dir():
 print(f"SSH dir {ssh_dir}: SKIP (no .ssh directory)")
 print("RESULT: SKIP - nothing to audit")
 return 0
 dir_mode = mode_of(ssh_dir)
 dir_flag = "OK" if dir_mode == "0o700" else "WARN (expected 0o700)"
 if dir_flag.startswith("WARN"):
 warnings += 1
 print(f"SSH dir {ssh_dir}: mode {dir_mode} {dir_flag}")
 for child in sorted(ssh_dir.iterdir()):
 if not child.is_file() or child.suffix == ".pub":
 continue
 if child.name in SKIP_NAMES or child.name.startswith("."):
 continue
 head = child.read_bytes()[:64]
 looks_like_key = (
 b"PRIVATE KEY" in head
 or child.name.startswith("id_")
 or child.name.endswith((".pem", ".key"))
 )
 if not looks_like_key:
 continue
 file_mode = mode_of(child)
 exposed = bool(stat.S_IMODE(child.stat().st_mode) & 0o077)
 flag = "OK" if not exposed else f"WARN (mode {file_mode} is group/other-readable)"
 if exposed:
 warnings += 1
 print(f"private key {child.name}: mode {file_mode} {flag}")
 auth_keys = ssh_dir / "authorized_keys"
 if not auth_keys.is_file():
 print(f"{auth_keys}: SKIP (no authorized_keys file)")
 else:
 ak_mode = mode_of(auth_keys)
 ak_flag = "OK" if ak_mode in ("0o600", "0o400") else f"WARN (mode {ak_mode}, expected 0o600)"
 if ak_flag.startswith("WARN"):
 warnings += 1
 print(f"authorized_keys: mode {ak_mode} {ak_flag}")
 for lineno, raw in enumerate(
 auth_keys.read_text(encoding="utf-8").splitlines(), 1
 ):
 line = raw.strip()
 if not line or line.startswith("#"):
 continue
 checked_keys += 1
 entry = parse_authorized_key(line, lineno)
 notes = []
 if entry["type"] in WEAK_KEY_TYPES:
 notes.append("legacy algorithm")
 if entry["type"] == "<unparsable>":
 notes.append("could not parse key type")
 if not entry["restricted"]:
 notes.append("no restriction (no command=/from=/restrict)")
 if notes:
 warnings += 1
 print(
 f"authorized_keys line {lineno}: "
 f"{entry['type']} WARN ({'; '.join(notes)})"
 )
 else:
 print(
 f"authorized_keys line {lineno}: "
 f"{entry['type']} OK (restricted)"
 )
 print("passphrase: NOT CHECKED here (use `ssh-keygen -y -f <key>` separately)")
 if checked_keys == 0:
 print(f"RESULT: no authorized_keys entries checked; warnings={warnings}")
 else:
 print(f"RESULT: {checked_keys} authorized_keys entries checked; warnings={warnings}")
 return 0


if __name__ == "__main__":
 raise SystemExit(main())

The script checks three things. First, modes: ~/.ssh should be 0o700, private keys 0o600 or stricter, authorized_keys 0o600 or 0o400. Second, it parses each authorized_keys line, splitting quoted command="..." correctly, and flags entries lacking command=, from=, or restrict. Third, it flags legacy ssh-rsa and ssh-dss while accepting Ed25519, ECDSA, and FIDO-backed sk- types. Passphrases are invisible in file metadata, so that check reports NOT CHECKED and points at ssh-keygen -y.

For a world-readable id_rsa, 0o755 ~/.ssh, and an unrestricted ssh-rsa first key:

SSH dir /home/alex/.ssh: mode 0o755 WARN (expected 0o700)
private key id_rsa: mode 0o644 WARN (mode 0o644 is group/other-readable)
authorized_keys: mode 0o600 OK
authorized_keys line 1: ssh-rsa WARN (legacy algorithm; no restriction (no command=/from=/restrict))
authorized_keys line 2: ssh-ed25519 OK (restricted)
passphrase: NOT CHECKED here (use `ssh-keygen -y -f <key>` separately)
RESULT: 2 authorized_keys entries checked; warnings=3

Each WARN is a cleanup ticket: delete the entry, add a restriction, regenerate the key, or tighten the mode. Only the local account is audited; sshd_config and certificate authorities need their own review.

Sources

OpenBSD sshd manual, authorized_keys format, key options, and authentication controls, checked 2026-09-12.
NIST IR 7966: Security of Interactive and Automated Access Management Using Secure Shell (SSH), key provisioning, rotation, and audit guidance, checked 2026-09-12.
GitHub Docs: Connecting to GitHub with SSH, generating keys, passphrases, and key types, checked 2026-09-12.

Auth · XB Field Notes

Basic auth carries a reusable credential

Understand the actual exchange

When it breaks

Check it quickly

Sources

SSH key hygiene is mostly limiting where a key works

A key should read as an identity

Scope is the point

Rotation and the audit trail

When it breaks

Check it quickly

Further reading

Sources