I use public/private with the private key handled by Yubikey PIV functionality.
Poll HN: Do you use SSH certificates (not mere public-key authentication)?
31–40 of 156 posts
Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?
#32Doing this without something like Vault is very difficult. Vault is designed to provide similar guarantees to an HSM (it's a service designed to make keys usable but not exfiltratable), and that's essential for any long-lived certificates.
Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?
#33We looked into them once at work for our "conventional" SSH infrastructure, but immediately rammed into the wall that a certificate can sign a key, but you can't have a full PKI infrastructure like SSL where certs can sign certs that can sign keys. Without the ability to delegate, the logistics of needing to create an absolutely centralized authority to do the useful things we wanted to do within the organization rai…
> On the other side, as a personal user of SSH with basically one person to worry about, the effort of setting up a certificate seems like just a waste versus the existing key-based infrastructure; I don't understand at all what attack it would prevent or what convenience it would provide for the cost of learning it.
The main benefit I get from using SSH certs at home is expiration. Before, I always had a niggling feeling at the back of my mind that the public key I’d been using for four years could have been surreptitiously exfiltrated by some shell script three years ago, and I’d never notice.
Now my certificates expire regularly, so I no longer have to worry about whether my machine remained secure throughout the entire continuous past; I only have to worry if my machine is secure in the present.
Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?
#34We looked into them once at work for our "conventional" SSH infrastructure, but immediately rammed into the wall that a certificate can sign a key, but you can't have a full PKI infrastructure like SSL where certs can sign certs that can sign keys. Without the ability to delegate, the logistics of needing to create an absolutely centralized authority to do the useful things we wanted to do within the organization rai…
> Without the ability to delegate, the logistics of needing to create an absolutely centralized authority to do the useful things we wanted to do within the organization raised the cost of "first value" too high for us to fuss over.
Have you considered integrating this with the SSO provider you are almost certainly already using as 1k strong org? Basically, create groups in Okta or whatever you’re using, delegate management of these groups to whoever you want, and then configure Teleport to use those groups for authorization in various contexts.
Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?
#35I store my authorized_keys in DNS TXT records, that are DNSSEC signed, with a validating resolver on the box. I then just use "/usr/bin/hesinfo %u ssh" as my AuthorizedKeysCommand in OpenSSH. I wrote a little tool that allowed you to "#include" other DNS records etc, but "hesinfo" is generally easily installable/available so it's just easier.
I would love a HOWTO link.
Also, can the DNS server be public facing? Any issues with the authorized keys being public (AFAICT there isnt but i am not a security expert)?
Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?
#36We looked into them once at work for our "conventional" SSH infrastructure, but immediately rammed into the wall that a certificate can sign a key, but you can't have a full PKI infrastructure like SSL where certs can sign certs that can sign keys. Without the ability to delegate, the logistics of needing to create an absolutely centralized authority to do the useful things we wanted to do within the organization rai…
> On the other side, as a personal user of SSH with basically one person to worry about, the effort of setting up a certificate seems like just a waste versus the existing key-based infrastructure; I don't understand at all what attack it would prevent or what convenience it would provide for the cost of learning it. The main benefit I get from using SSH certs at home is expiration. Before, I always had a niggling fe…
How do you issue client certificates? Do you not worry that the private key needed to issue these can also leak just the same as your personal private key?
Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?
#37Bearing in mind that, on principle, I never expose ssh to untrusted hosts/networks, for many years my solution for ssh-SSO was GSSAPI. Typically this would be a two part auth, where gssapi-kex had to succeed, _and_ the connecting user had to supply the kerberos password on the server side via PAM/keyboard-interactive to reduce the risk of "sysadmin walked away and left screen unlocked."
I think this approach has fallen out of favour these days compared to PKI, but I haven't been an enterprise sysadmin in a few years.
Edit: for those curious, ephemeral access in this case is easily enough managed via e.g. the usual AD-on-*nix methods. It doesn't scale beyond a few dozen systems, but the scenario described above was back before scale-out became the fashion.
Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?
#38I store my authorized_keys in DNS TXT records, that are DNSSEC signed, with a validating resolver on the box. I then just use "/usr/bin/hesinfo %u ssh" as my AuthorizedKeysCommand in OpenSSH. I wrote a little tool that allowed you to "#include" other DNS records etc, but "hesinfo" is generally easily installable/available so it's just easier.
Hesiod, now there’s a name I haven’t heard in a long time
Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?
#39I've used public-key basically forever. I have wanted to go that step further and implement certificates for a good few years now, I absolutely see the value, no question about it (i.e. no more out of date authorized_keys files, no need to even install authorized_keys files in the first place, the list goes on). I wish YubiKeys were more flexible in allowing SSH certificates to be hosted on them (currently can only h…
using yubikeys in fido2 as the CA key just works, and the cert is its public key
what doesn't work is storing the signed certificates
Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?
#40We looked into them once at work for our "conventional" SSH infrastructure, but immediately rammed into the wall that a certificate can sign a key, but you can't have a full PKI infrastructure like SSL where certs can sign certs that can sign keys. Without the ability to delegate, the logistics of needing to create an absolutely centralized authority to do the useful things we wanted to do within the organization rai…
> On the other side, as a personal user of SSH with basically one person to worry about, the effort of setting up a certificate seems like just a waste versus the existing key-based infrastructure; I don't understand at all what attack it would prevent or what convenience it would provide for the cost of learning it. The main benefit I get from using SSH certs at home is expiration. Before, I always had a niggling fe…
The certificates expire, but not the keys. This turns the CA and all points in between into a pretty major target, while SSH private keys reside only on the user's workstation, are personal to the user (reducing the scope), and are easily rotated by the user (well, more easily than CA!). Tools like userify also empowers the user to revoke their own keys globally, even from their phone, just by blanking out the authorized_keys box.
Userify also lets you force key rotation for your team and automatically removes their accounts from servers if they don't rotate quickly enough.