71–80 of 156 posts
For those curious about how SSH CAs and key signing works, I wrote a blog post about that awhile ago: https://dmuth.medium.com/ssh-at-scale-cas-and-principals-b27... I also created a "playground" which can be used to stand up such an environment running in Docker containers to better understand the process: https://github.com/dmuth/ssh-principal-and-ca-playground Hope folks here find them helpful.
I don't see the benefit of using certificates for personal use. In my mind, certificates only really shine when administering a fleet of servers in a large company, as it eliminates the need to update the authorized_keys file on every server someone is hired or leaves. I could be missing some less obvious use cases, but if you're just authenticating to your personal machines, it doesn't seem worth it. It's not any mo…
For big organizations security is by-definition lax (you have to trust lots of non-trustworthy employees), but there's no reason to accept this compromise for smaller companies or personal use.
I've used public-key basically forever. I have wanted to go that step further and implement certificates for a good few years now, I absolutely see the value, no question about it (i.e. no more out of date authorized_keys files, no need to even install authorized_keys files in the first place, the list goes on). I wish YubiKeys were more flexible in allowing SSH certificates to be hosted on them (currently can only h…
ssh-keygen -D opensc-pkcs11.so -e > cert-on-piv.ssh
( echo -n "cert-authority "; cat cert-on-piv.ssh ) >> ~/.ssh/authorized_keys
name="temp-$(date +%Y%m%d-%H%M)"
ssh-keygen -q -N '' -C "${name}" -t rsa-sha2-256 -f ${name}
ssh-keygen -t rsa-sha2-256 -s cert-on-piv.ssh -D opensc-pkcs11.so -V -1d:+1d -I ${name} ${name}.pub
ssh-add -t 1d ${name}
rm -f ${name} ${name}.pub ${name}-cert.pub
I store my authorized_keys in DNS TXT records, that are DNSSEC signed, with a validating resolver on the box. I then just use "/usr/bin/hesinfo %u ssh" as my AuthorizedKeysCommand in OpenSSH. I wrote a little tool that allowed you to "#include" other DNS records etc, but "hesinfo" is generally easily installable/available so it's just easier.
I would love a HOWTO link. Also, can the DNS server be public facing? Any issues with the authorized keys being public (AFAICT there isnt but i am not a security expert)?
Earlier quoted context omitted.
There is technically one minor one, which really isn't one - but you should be aware of. Someone can take your authorized keys and add them to a box they control, and trick you into logging in. However, this would trigger the "new host" warning SSH gives you, and you can minimize this by minimizing which hosts you allow your private keys to be used on. And if someone is so actively trying to attack you they probably…
This wouldn't matter anyway because the server can just give you access regardless of the auth provided.
This can double not only has a PKI for hosts and users using SSH connections but you can also use the PKI for signature verification of arbitrary data.