Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Poll HN: Do you use SSH certificates (not mere public-key authentication)?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 156 posts

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#41

Post by cubesnooper »

xyzzyz wrote: post #36
cubesnooper wrote: post #33

Earlier quoted context omitted.

> On the other side, as a personal user of SSH with basically one person to worry about, the effort of setting up a certificate seems like just a waste versus the existing key-based infrastructure; I don't understand at all what attack it would prevent or what convenience it would provide for the cost of learning it. The main benefit I get from using SSH certs at home is expiration. Before, I always had a niggling fe…

How do you issue client certificates? Do you not worry that the private key needed to issue these can also leak just the same as your personal private key?

I have a Raspberry Pi dedicated to generating certificates. It serves the files to my LAN statically via a webserver, and is otherwise heavily firewalled. I don't run any other software on the Pi, so barring an exploit in the webserver, I’m not worried about the signing key getting compromised.

Compared to my desktop, where over the years I ran all kinds of stuff from the package manager, downloaded Python scripts and configure scripts from GitHub and Sourceforge… I tried to be careful but you can’t audit everything.

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#42

Post by cubesnooper »

gunapologist99 wrote: post #40
cubesnooper wrote: post #33

Earlier quoted context omitted.

> On the other side, as a personal user of SSH with basically one person to worry about, the effort of setting up a certificate seems like just a waste versus the existing key-based infrastructure; I don't understand at all what attack it would prevent or what convenience it would provide for the cost of learning it. The main benefit I get from using SSH certs at home is expiration. Before, I always had a niggling fe…

The certificates expire, but not the keys. This turns the CA and all points in between into a pretty major target, while SSH private keys reside only on the user's workstation, are personal to the user (reducing the scope), and are easily rotated by the user (well, more easily than CA!). Tools like userify also empowers the user to revoke their own keys globally, even from their phone, just by blanking out the author…

Rotation is actually a lot easier with certificates. I just generate a new key on the client, copy the public key to the CA, and I’m done, with no need to repopulate authorized_keys on all my other machines.

In another comment I went into more detail about how I keep the CA secure.

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#43

Post by theblazehen »

bshep wrote: post #35
dotwaffle wrote: post #20

I store my authorized_keys in DNS TXT records, that are DNSSEC signed, with a validating resolver on the box. I then just use "/usr/bin/hesinfo %u ssh" as my AuthorizedKeysCommand in OpenSSH. I wrote a little tool that allowed you to "#include" other DNS records etc, but "hesinfo" is generally easily installable/available so it's just easier.

I would love a HOWTO link. Also, can the DNS server be public facing? Any issues with the authorized keys being public (AFAICT there isnt but i am not a security expert)?

There are none. In fact yours is already public: https://github.com/bshep.keys

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#44

Post by snowstormsun »

dotwaffle wrote: post #20

I store my authorized_keys in DNS TXT records, that are DNSSEC signed, with a validating resolver on the box. I then just use "/usr/bin/hesinfo %u ssh" as my AuthorizedKeysCommand in OpenSSH. I wrote a little tool that allowed you to "#include" other DNS records etc, but "hesinfo" is generally easily installable/available so it's just easier.

doesn't this approach run into caching problems?

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#45

Post by StewardMcOy »

I don't see the benefit of using certificates for personal use. In my mind, certificates only really shine when administering a fleet of servers in a large company, as it eliminates the need to update the authorized_keys file on every server someone is hired or leaves.

I could be missing some less obvious use cases, but if you're just authenticating to your personal machines, it doesn't seem worth it. It's not any more secure than SSH keys, and you have to also manage and secure your CA key.

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#46

Post by strobegoodsong »

dotwaffle wrote: post #20

I store my authorized_keys in DNS TXT records, that are DNSSEC signed, with a validating resolver on the box. I then just use "/usr/bin/hesinfo %u ssh" as my AuthorizedKeysCommand in OpenSSH. I wrote a little tool that allowed you to "#include" other DNS records etc, but "hesinfo" is generally easily installable/available so it's just easier.

Please write a blog on this

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#47

Post by bombcar »

theblazehen wrote: post #43
bshep wrote: post #35

Earlier quoted context omitted.

I would love a HOWTO link. Also, can the DNS server be public facing? Any issues with the authorized keys being public (AFAICT there isnt but i am not a security expert)?

There are none. In fact yours is already public: https://github.com/bshep.keys

There is technically one minor one, which really isn't one - but you should be aware of.

Someone can take your authorized keys and add them to a box they control, and trick you into logging in.

However, this would trigger the "new host" warning SSH gives you, and you can minimize this by minimizing which hosts you allow your private keys to be used on.

And if someone is so actively trying to attack you they probably have more direct methods available.

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#48

Post by dmuth »

For those curious about how SSH CAs and key signing works, I wrote a blog post about that awhile ago: https://dmuth.medium.com/ssh-at-scale-cas-and-principals-b27...

I also created a "playground" which can be used to stand up such an environment running in Docker containers to better understand the process: https://github.com/dmuth/ssh-principal-and-ca-playground

Hope folks here find them helpful.

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#49

Post by candiddevmike »

dotwaffle wrote: post #20

I store my authorized_keys in DNS TXT records, that are DNSSEC signed, with a validating resolver on the box. I then just use "/usr/bin/hesinfo %u ssh" as my AuthorizedKeysCommand in OpenSSH. I wrote a little tool that allowed you to "#include" other DNS records etc, but "hesinfo" is generally easily installable/available so it's just easier.

This method puts a lot of reliance on DNSSEC working and trusting that it is preventing spoofing. I personally wouldn't rely on this in production, there are too many stories about DNSSEC cutovers rendering the domain unresolvable for hours+. Imagine not being able to get to your servers too...!

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#50

Post by XiS »

tomaslaureano wrote: post #28
XiS wrote: post #17

Earlier quoted context omitted.

As an alternative, you might consider using an ed25519-sk ssh key so you can use your YubiKey as a second factor during authentication. I've got my keys loaded up in the SSH agent by KeepassXC when I open my database and can log in to a box just by pressing my YubiKey. No keys on disk, no passwords to remember (except your Keepass master key ofcourse).

Would love to know more about this workflow!

It's pretty much a combination the following:

- https://keepassxc.org/docs/#faq-ssh-agent-how

- https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...

You could probably also put the SSH key itself as a resident key on the YubiKey. But personally I like the fact the key and 2FA aren't on the same device (and the fact you can only get my key when you know the KeepassXC master password).

Post reply on HN