Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Poll HN: Do you use SSH certificates (not mere public-key authentication)?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 156 posts

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#61

Post by thayne »

sofixa wrote: post #10
ultra_nick wrote: post #5

What's the difference between a certificate and a public/private keys?

Certificate is short lived and signed on the fly for when you need it. The server trusts your SSH CA, and you can ask it to sign any private key you want, with a ttl. So you get extra security (credentials are dynamic and short -lived, and also per-user if needed) and lower maintenance because you only have the SSH CA public key to setup on all machines and that one needs less rotation/updates than public keys.

A certificate doesn't necessarily have to be short lived, although in practice they usually are.

The main difference is that with an ssh key, you install the public key directly on the target host. With a certificate, you Just tell the host to trust a CA, and use that CA to sign client certificates.

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#63

Post by mdeeks »

rkangel wrote: post #53

My hope is to make this problem mostly redundant among my machines through use of tailscale. Tailscale SSH means that I don't have to worry about SSH keys at all - it just uses the same auth as the rest of tailscale. Only downside is that at the moment it doesn't play with SELinux which is a bit unhelpful for me given I mostly use Fedora.

For personal use cases this the the best option by far IMHO.

At work we deployed Tailscale company wide but we almost entirely use subnet routers and don't have Tailscale on each node. So it only gets you as far as an SSH bastion. We instead rely on standard SSH keys to reach individual nodes and another third party service that dynamically provisions accounts and authorized_keys on machines when you try to login.

I would kill for something as simple and clean as Tailscale SSH for all of our nodes at work. Especially since it has ACLs and optional "check mode" which forces re-auth/2FA for high risk nodes.

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#64

Post by archi42 »

tptacek wrote: post #57
vngzs wrote: post #32

Doing this without something like Vault is very difficult. Vault is designed to provide similar guarantees to an HSM (it's a service designed to make keys usable but not exfiltratable ), and that's essential for any long-lived certificates.

I don't know that I disagree with the broader point here, but long-lived certificates are what you don't want.

Not GP, but I'd assume they talked about the root cert? You don't want to roll out a new one every other week ;-)

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#65

Post by dcow »

bombcar wrote: post #47
theblazehen wrote: post #43

Earlier quoted context omitted.

There are none. In fact yours is already public: https://github.com/bshep.keys

There is technically one minor one, which really isn't one - but you should be aware of. Someone can take your authorized keys and add them to a box they control, and trick you into logging in. However, this would trigger the "new host" warning SSH gives you, and you can minimize this by minimizing which hosts you allow your private keys to be used on. And if someone is so actively trying to attack you they probably…

What? How? What does putting my authorized keys file on another host do in terms of tricking me to log in? Authorized keys only matters on the host you are using when you type `ssh `. The ssh client compares the public key of the remote host to the list in your `authorized_keys` file and, only if there is a match, skips serving you TOFU.

EDIT: I mixed up authorized_keys and known_hosts. But, the remote server doesn't need your authorized_keys file to grant you access so not sure the visibility of authorized_keys matters.

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#66

Post by cubesnooper »

dcow wrote: post #65
bombcar wrote: post #47

Earlier quoted context omitted.

There is technically one minor one, which really isn't one - but you should be aware of. Someone can take your authorized keys and add them to a box they control, and trick you into logging in. However, this would trigger the "new host" warning SSH gives you, and you can minimize this by minimizing which hosts you allow your private keys to be used on. And if someone is so actively trying to attack you they probably…

What? How? What does putting my authorized keys file on another host do in terms of tricking me to log in? Authorized keys only matters on the host you are using when you type `ssh `. The ssh client compares the public key of the remote host to the list in your `authorized_keys` file and, only if there is a match, skips serving you TOFU. EDIT: I mixed up authorized_keys and known_hosts . But, the remote server doesn'…

You’re thinking of known_hosts, not authorized_keys.

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#67

Post by lapser »

bombcar wrote: post #47
theblazehen wrote: post #43

Earlier quoted context omitted.

There are none. In fact yours is already public: https://github.com/bshep.keys

There is technically one minor one, which really isn't one - but you should be aware of. Someone can take your authorized keys and add them to a box they control, and trick you into logging in. However, this would trigger the "new host" warning SSH gives you, and you can minimize this by minimizing which hosts you allow your private keys to be used on. And if someone is so actively trying to attack you they probably…

This wouldn't matter anyway because the server can just give you access regardless of the auth provided.

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#68

Post by iambvk »

dotwaffle wrote: post #20

I store my authorized_keys in DNS TXT records, that are DNSSEC signed, with a validating resolver on the box. I then just use "/usr/bin/hesinfo %u ssh" as my AuthorizedKeysCommand in OpenSSH. I wrote a little tool that allowed you to "#include" other DNS records etc, but "hesinfo" is generally easily installable/available so it's just easier.

What is the benefit?

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#69

Post by lapser »

For folks on AWS I highly recommend investing in SSH over SSM in combination with EC2 Instance Connect. You can generate temporary ssh keys, send it to EC2 Instance Connect, it'll be on the server for 60 seconds. Then you can use ssm start-session to connect to the server over SSM. This also allows you to disable SSH ingress, and doesn't need a bastion or VPN.

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#70

Post by dcow »

cubesnooper wrote: post #66
dcow wrote: post #65

Earlier quoted context omitted.

What? How? What does putting my authorized keys file on another host do in terms of tricking me to log in? Authorized keys only matters on the host you are using when you type `ssh `. The ssh client compares the public key of the remote host to the list in your `authorized_keys` file and, only if there is a match, skips serving you TOFU. EDIT: I mixed up authorized_keys and known_hosts . But, the remote server doesn'…

You’re thinking of known_hosts, not authorized_keys.

You are right, I am. Now I understand the DNSSEC setup.
Post reply on HN