Huge iTerm2 SSH Vulnerability

[@GottZ]

I know my comment isn't really constructive.. but watching this in 720p on a 4k screen is hilarious in 2025

[@JohnCodes]

100% my bad: thought my OBS settings when I recorded this were on the right profile but it captured at 720p :(

[@randomgeocacher]

Not familiar with this terminal but in general you’d use user unique file names, often under $USER. And set proper permissions. Most shells log .history in defaults so reasonable logging under user is considered okay. mktemp could be an option if you want a random file under /tmp. So imho the larger issue isn’t how the logger verbosity was configured, but that location and perms was wrong.

[@scottstillwell3150]

Ironic that I just recently switched to Ghostty myself...but I just upgraded my iTerm2 anyway. I have always just used the default profile with Login Shell rather than SSH, and then manually ssh to whatever host I'm connecting to. I don't use the program as a connection manager. Good video, though...thanks for the heads-up!

[@JohnCodes]

Yeah Ghostty has been great!

[@Sam_Body]

Should `read -s` or even without `-s` help? Are we see input or output data, or shell configuration itself logged with all the ephemeral env variables?

[@JohnCodes]

It's all raw input and output. So anything that goes through as ins or outs will be logged to the file. Best thing is to remove the file from remote hosts, upgrade iterm2, and depending on your risk profile, rotate keys and passwords.

[@conceptrat]

Does this mean that iterm2 is writing data to this file in the background? I don't even understand why the logging would be done on the host you're connecting to? Surely it should be output on the machine initiating the connection.

[@JohnCodes]

The way that I understand how the ssh integration works is there's a small script that is installed on the remote host to integrate with a connected iterm2 client. It's a very lite-weight integration intended to make ssh-ing into many different hosts with many different configs easier. But you run the risk of this sort of thing happening

[@Mordinel]

The openssh client is already completely configurable, I see no reason to make these configurations in my terminal emulator rather than in my ~/.ssh/config file.

[@JavierHarford]

I knew this was coming.... iterm2 has felt janky for years