I can't tell the benefits of this vs running an SSH CA that supports OIDC. In that scenario, the server just needs to trust the CAs key, rather than running some sort of verifier.
Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
21–30 of 156 posts
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#22I don't love this. > Unfortunately, while ID Tokens do include identity claims like name, organization, and email address, they do not include the user’s public key. This prevents them from being used to directly secure protocols like SSH This seems like dubious statement. SSH authentication does not need to be key based. I understand the practicality of their approach, but I would have preferred this to be proper fi…
ssh -k is too enterprise for ̶t̶e̶c̶h̶b̶r̶o̶ ̶s̶t̶a̶r̶t̶u̶p̶s̶ small companies that don't want to setup a kerberos realm
If you mention Kerberos to most "security" people these days they will think you're talking about Kubernetes.
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#23[Note on edit: this is wrong] ... apparently in the form of a whole new implementation. Not realistic. If it's not in OpenSSH, it effectively doesn't exist.
Author of the blog here and main opkssh contributor. The title is wrong but this is OpenSSH and not a whole new implementation. opkssh uses the OpenSSH AuthorizedKeysCommand configuration option like AWS instance-connect to add OpenID Connect validation to OpenSSH authentication. ``` opkssh login ``` Generates a valid ssh key in `~/.ssh/` Then run bog standard ssh or sftp ``` ssh user@hostname ``` ssh will pull this…
I'm surprised it defaults to writing out key material into the filesystem[1] when SSH Agent has existed for quite a while. This use case seems especially relevant to sticking them in the agent given that (IIUC) these are short-lived certs anyway, so if your agent bounced you'd just get a fresh one without drama
I do see https://github.com/openpubkey/opkssh/issues/6#issuecomment-2...> so I'm glad it's conceptually on the radar, I'm just saying I'm surprised it wasn't part of Cloudflare's best practices already
1: https://github.com/openpubkey/opkssh/blob/v0.3.0/commands/lo...
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#24Earlier quoted context omitted.
> This seems like dubious statement. SSH authentication does not need to be key based. Let's say you just use an ID Token as a bearer token to authenticate to SSH. The SSH server now has the secret you used to authenticate with. Doesn't this introduce replay attacks where the SSH server can replay your ID Token to log into other SSH servers? Whereas if your ID Token functions like a "certificate" issued by your IDP b…
> The SSH server now has the secret you used to authenticate with. secrets can be made unique per connection and single use
this ^
GSSAPI can be more secured than public/private key if configured right.
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#25I don't love this. > Unfortunately, while ID Tokens do include identity claims like name, organization, and email address, they do not include the user’s public key. This prevents them from being used to directly secure protocols like SSH This seems like dubious statement. SSH authentication does not need to be key based. I understand the practicality of their approach, but I would have preferred this to be proper fi…
Yeah, I don't like this approach either. There was a lot of plumbing added to sshd to support pluggable auth methods, and having used a few of them (including TOTP, for instance), I am not really a fan of "extending" publickey.
(Am also not really a fan of having to eventually use a browser for authenticating a terminal session, but that's another problem.)
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#26[Note on edit: this is wrong] ... apparently in the form of a whole new implementation. Not realistic. If it's not in OpenSSH, it effectively doesn't exist.
It states that it doesn’t require major changes because it all happens under the SSH protocol. A new program is needed on the client to sign in and you can already run a custom program on the server to authorize the key.
Lost me at "A new program is needed on the client". Completely.
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#27I don't love this. > Unfortunately, while ID Tokens do include identity claims like name, organization, and email address, they do not include the user’s public key. This prevents them from being used to directly secure protocols like SSH This seems like dubious statement. SSH authentication does not need to be key based. I understand the practicality of their approach, but I would have preferred this to be proper fi…
Googling around I see lot of work around this topic. One example is "Moonshot" project from Janet/Géant and the closely related abfab ietf wg
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#28I can't tell the benefits of this vs running an SSH CA that supports OIDC. In that scenario, the server just needs to trust the CAs key, rather than running some sort of verifier.
The benefits of this is that you don't have the attack surface of an SSH CA. If you do this with an SSH CA that supports OIDC, if either the IDP or the SSH CA are compromised then security is lost.
With OpenPubkey and by extension opkssh, your IDP is functioning like the SSH CA by signing the public key that you make the SSH connection with. Thus, you have one fewer trusted party and you don't have maintain and secure an SSH CA.
Beyond this, rotating SSH CAs is hard because you need to put the public key of the SSH CA on each SSH server and SSH certs don't support intermediate certificates. Thus if you SSH CA is hacked, you need to update the CA public key on all your servers and hope you don't miss any. OpenID Connect IDPs rotate their public keys often and if they get hacked and they can immediately rotate their public keys without any update to relying servers.
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#29People could already cook up something similar using AuthorizedKeysCommand and similar. As long as you can upload some kind of key to an external system (eg: short-lived ssh certificate) you can then query that certificate via AuthorizedKeysCommand. Edit: just saw the comment by the author of the post ( https://news.ycombinator.com/item?id=43471793 ). Yep, it's AuthorizedKeysCommand. Good job!
I gotta say, I love AuthorizedKeysCommand, it is the most clever configuration option I've seen in a protocol! If you just try to stuff a ID Token into an SSH key and use AuthorizedKeysCommands you introduce replay attacks because the SSH server can pull your ID Token out and stuff it into another SSH key and replay it to other SSH servers to impersonate you. Opkssh doesn't have this weakness because it used OpenPubk…
OpenSSH is full of clever ideas.
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#30Now I have to trust OpenPubkey, hoping it wont get hacked. No way will I add this to my servers, I will keep using the long live public key.