Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

blog.cloudflare.com

Post reply on HN
Print view View original

31–40 of 156 posts

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#31

Post by notTooFarGone »

zokier wrote: post #10

I don't love this. > Unfortunately, while ID Tokens do include identity claims like name, organization, and email address, they do not include the user’s public key. This prevents them from being used to directly secure protocols like SSH This seems like dubious statement. SSH authentication does not need to be key based. I understand the practicality of their approach, but I would have preferred this to be proper fi…

I do love this - everything that makes passwords less used makes the world more secure. Everything that is additionally user friendly has the potential to be the new let's encrypt.

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#32

Post by bayindirh »

ciaovietnam wrote: post #30

Now I have to trust OpenPubkey, hoping it wont get hacked. No way will I add this to my servers, I will keep using the long live public key.

If you want to roll your own, here's another implementation which people already use, with their own OpenID Connect infrastructures.

You can deploy and use in a completely closed system.

https://github.com/EOSC-synergy/ssh-oidc

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#33

Post by notTooFarGone »

EthanHeilman wrote: post #13

Author of the blog post and main opkssh contributor here, happy to answer any questions.

We are currently struggling with the exact ergonomics of user friendly and secure ssh and I just wanted to say you helped big time here!

Will test this for my current use-case and hopefully contribute in the future!

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#34

Post by EthanHeilman »

confiq wrote: post #24
slt2021 wrote: post #19

Earlier quoted context omitted.

> The SSH server now has the secret you used to authenticate with. secrets can be made unique per connection and single use

this ^ GSSAPI can be more secured than public/private key if configured right.

Can you explain more? I want to be a fan of GSSAPI

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#35

Post by bayindirh »

notTooFarGone wrote: post #31
zokier wrote: post #10

I don't love this. > Unfortunately, while ID Tokens do include identity claims like name, organization, and email address, they do not include the user’s public key. This prevents them from being used to directly secure protocols like SSH This seems like dubious statement. SSH authentication does not need to be key based. I understand the practicality of their approach, but I would have preferred this to be proper fi…

I do love this - everything that makes passwords less used makes the world more secure. Everything that is additionally user friendly has the potential to be the new let's encrypt.

I'd love to see the central repository to be breached and tons of computers get new users instantly.

I mean, the idea is nice. There's an alternative implementation being used already in some parts of the world, but their own OIDC provider of their choice.

Decentralization is the key here.

I can neither confirm nor deny the pun is intended.

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#36

Post by radlad »

samcat116 wrote: post #21

I can't tell the benefits of this vs running an SSH CA that supports OIDC. In that scenario, the server just needs to trust the CAs key, rather than running some sort of verifier.

Years ago, I tried building something like this using ProxyCommand to try to fetch the SSH certificate "just-in-time" without having to run a command first, but unfortunately the ordering of OpenSSH was such that ProxyCommand ran after checking the disk for SSH certs/keys. :(

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#37

Post by EthanHeilman »

notTooFarGone wrote: post #33
EthanHeilman wrote: post #13

Author of the blog post and main opkssh contributor here, happy to answer any questions.

We are currently struggling with the exact ergonomics of user friendly and secure ssh and I just wanted to say you helped big time here! Will test this for my current use-case and hopefully contribute in the future!

Excellent, feel free to email me at ethan.r.heilman[at]gmail[]com. Happy to in anyway

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#38

Post by dcow »

confiq wrote: post #24
slt2021 wrote: post #19

Earlier quoted context omitted.

> The SSH server now has the secret you used to authenticate with. secrets can be made unique per connection and single use

this ^ GSSAPI can be more secured than public/private key if configured right.

Doesn’t this require the server to consult the IDP on every log in, though, to make sure the id token is valid? One of the staples of ssh from a UX standpoint is that it’s peer to peer.

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#39

Post by dcow »

rcarmo wrote: post #22
gfody wrote: post #17

Earlier quoted context omitted.

ssh -k is too enterprise for ̶t̶e̶c̶h̶b̶r̶o̶ ̶s̶t̶a̶r̶t̶u̶p̶s̶ small companies that don't want to setup a kerberos realm

If you mention Kerberos to most "security" people these days they will think you're talking about Kubernetes.

really? that’s a shame

kerberos is old and clunky but conceptually it got so much right. I’m so sick of the modern idea that i should wake up and babysit my machine through N different oauth dances to log in to all the services i need on a daily basis. once I authenticate once I should be implicitly authenticated everywhere.

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#40

Post by EthanHeilman »

ciaovietnam wrote: post #30

Now I have to trust OpenPubkey, hoping it wont get hacked. No way will I add this to my servers, I will keep using the long live public key.

OpenPubkey is software and opensource. All software has vulnerabilities but we aren't a service or SaaS or anything.
Post reply on HN