From 991feac93f93b114ec8bb816fa2178cecabab982 Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Fri, 29 May 2026 15:09:00 -0400
Subject: [PATCH 1/2] Add hardened SSH client config

- Add ssh/config with secure defaults for Host *: HashKnownHosts, AddKeysToAgent,
  IdentitiesOnly, VisualHostKey, StrictHostKeyChecking ask
- Add a github.com Host block using ~/.ssh/id_ed25519
- Symlink ssh/config -> ~/.ssh/config in assimilate.sh and enforce
  chmod 700 ~/.ssh + chmod 600 ~/.ssh/config (SSH rejects loose permissions)
---
 assimilate.sh |  4 +++-
 ssh/config    | 20 ++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 ssh/config

diff --git a/assimilate.sh b/assimilate.sh
index bacc724..144911d 100755
--- a/assimilate.sh
+++ b/assimilate.sh
@@ -66,10 +66,12 @@ sym tmux-powerline/themes/theme.sh  .config/tmux-powerline/themes/theme.sh
 sym claude/statusline.sh            .claude/statusline.sh
 sym agent-instructions.md           .claude/CLAUDE.md
 sym agent-instructions.md           .codex/AGENTS.md
+sym ssh/config                      .ssh/config
 
 # Lock down sensitive symlink targets (chmod follows the symlink to the repo file).
 chmod 600 "$HOME/.gitconfig"
-[ -d "$HOME/.ssh" ] && chmod 700 "$HOME/.ssh"
+chmod 700 "$HOME/.ssh"
+chmod 600 "$HOME/.ssh/config"
 
 # bashrc: symlinked on macOS; sourced from a stub on Linux.
 # On the EC2 dev box, user_data appends a secrets/region block to .bashrc after
diff --git a/ssh/config b/ssh/config
new file mode 100644
index 0000000..ca62c29
--- /dev/null
+++ b/ssh/config
@@ -0,0 +1,20 @@
+# SSH client configuration (symlinked to ~/.ssh/config by assimilate.sh)
+
+Host *
+    # Hash hostnames in known_hosts so a leaked file doesn't reveal every
+    # server you've connected to.
+    HashKnownHosts yes
+    # Load a key into the agent on first use so you aren't re-prompted.
+    AddKeysToAgent yes
+    # Only offer keys explicitly configured for a host — don't spray every
+    # loaded key at every server (avoids leaking fingerprints / auth failures).
+    IdentitiesOnly yes
+    # Show an ASCII-art fingerprint on connect to help spot MITM on first use.
+    VisualHostKey yes
+    # Never silently auto-accept unknown host keys.
+    StrictHostKeyChecking ask
+
+Host github.com
+    HostName github.com
+    User git
+    IdentityFile ~/.ssh/id_ed25519

From d772ed6bf32af4b8976e9f24a57d26e90be6c0ca Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Sun, 5 Jul 2026 09:52:49 -0400
Subject: [PATCH 2/2] Support machine-local hosts via Include + keep macOS
 UseKeychain

The tracked config replaces ~/.ssh/config wholesale, which dropped the
existing machine-local Host entry and the UseKeychain setting. Include
config.local (untracked; repo is public) preserves per-machine hosts, and
IgnoreUnknown lets UseKeychain coexist with Linux ssh.
---
 ssh/config | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/ssh/config b/ssh/config
index ca62c29..f2a4dc7 100644
--- a/ssh/config
+++ b/ssh/config
@@ -1,9 +1,18 @@
 # SSH client configuration (symlinked to ~/.ssh/config by assimilate.sh)
 
+# Machine-local hosts live in ~/.ssh/config.local (not tracked — this repo is
+# public). ssh silently skips a missing Include, and entries there are read
+# first so they take precedence for their hosts.
+Include config.local
+
 Host *
     # Hash hostnames in known_hosts so a leaked file doesn't reveal every
     # server you've connected to.
     HashKnownHosts yes
+    # Store/read key passphrases from the macOS keychain. IgnoreUnknown keeps
+    # Linux ssh (which has no UseKeychain option) from erroring on it.
+    IgnoreUnknown UseKeychain
+    UseKeychain yes
     # Load a key into the agent on first use so you aren't re-prompted.
     AddKeysToAgent yes
     # Only offer keys explicitly configured for a host — don't spray every