Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
blog.cloudflare.com
Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
1–10 of 156 posts
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#2[Note on edit: this is wrong]
... apparently in the form of a whole new implementation.
Not realistic. If it's not in OpenSSH, it effectively doesn't exist.
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#3[Note on edit: this is wrong] ... apparently in the form of a whole new implementation. Not realistic. If it's not in OpenSSH, it effectively doesn't exist.
It states that it doesn’t require major changes because it all happens under the SSH protocol. A new program is needed on the client to sign in and you can already run a custom program on the server to authorize the key.
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#4[Note on edit: this is wrong] ... apparently in the form of a whole new implementation. Not realistic. If it's not in OpenSSH, it effectively doesn't exist.
From the article "OPKSSH does not require any code changes to the SSH server or client."
Looks like this is a sidecar application. So potentially very useful, also potentially very brittle.
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#5[Note on edit: this is wrong] ... apparently in the form of a whole new implementation. Not realistic. If it's not in OpenSSH, it effectively doesn't exist.
It states that it doesn’t require major changes because it all happens under the SSH protocol. A new program is needed on the client to sign in and you can already run a custom program on the server to authorize the key.
I stand corrected. Still not sure I'd want to expose my SSH infrastructure to the massive kludge tower that is OpenID, but it not being its own implementation of the actual SSH protocol is a huge plus.
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#6Earlier quoted context omitted.
It states that it doesn’t require major changes because it all happens under the SSH protocol. A new program is needed on the client to sign in and you can already run a custom program on the server to authorize the key.
I stand corrected. Still not sure I'd want to expose my SSH infrastructure to the massive kludge tower that is OpenID, but it not being its own implementation of the actual SSH protocol is a huge plus.
I imagine it wouldn't be for the system admins to use, it's for all the other users who can use terminal applications but always treat ssh keys as a nuisance and try to avoid them as much as possible.
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#7I think it’s kinda funny that a standard to return a public key in a token, and a server side auth binary that uses that to log you into SSH, are presented here as something groundbreaking.
I’m not trying to downplay actually doing it, but it’s been possible since openid connect was invented.
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#8[Note on edit: this is wrong] ... apparently in the form of a whole new implementation. Not realistic. If it's not in OpenSSH, it effectively doesn't exist.
Author of the blog here and main opkssh contributor. The title is wrong but this is OpenSSH and not a whole new implementation.
opkssh uses the OpenSSH AuthorizedKeysCommand configuration option like AWS instance-connect to add OpenID Connect validation to OpenSSH authentication.
``` opkssh login ```
Generates a valid ssh key in `~/.ssh/`
Then run bog standard ssh or sftp
``` ssh user@hostname ```
ssh will pull this ssh key from `~/.ssh/` and send it to sshd running on your server. If this key isn't in an AuthorizedKeys file sshd will send it to the AuthorizedKeysCommand which if configured to be `opkssh` will check your OpenID Connect credentials.
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#9People could already cook up something similar using AuthorizedKeysCommand and similar.
As long as you can upload some kind of key to an external system (eg: short-lived ssh certificate) you can then query that certificate via AuthorizedKeysCommand.
Edit: just saw the comment by the author of the post (https://news.ycombinator.com/item?id=43471793). Yep, it's AuthorizedKeysCommand.
Good job!
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#10I don't love this.
> Unfortunately, while ID Tokens do include identity claims like name, organization, and email address, they do not include the user’s public key. This prevents them from being used to directly secure protocols like SSH
This seems like dubious statement. SSH authentication does not need to be key based.
I understand the practicality of their approach, but I would have preferred this to be proper first-class authentication method instead of smuggling it through publickey auth method. SSH protocol is explicitly designed to support many different auth methods, so this does feel like a missed opportunity. I don't know openssh internals, but could this have been implemented through gssapi? That's the traditional route for ssh sso. If not gssapi, then something similar to it.