I swear to god people make things more complex solely because they plan to yank these things out from under us later.
Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
41–50 of 156 posts
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#42I don't love this. > Unfortunately, while ID Tokens do include identity claims like name, organization, and email address, they do not include the user’s public key. This prevents them from being used to directly secure protocols like SSH This seems like dubious statement. SSH authentication does not need to be key based. I understand the practicality of their approach, but I would have preferred this to be proper fi…
> This seems like dubious statement. SSH authentication does not need to be key based. Let's say you just use an ID Token as a bearer token to authenticate to SSH. The SSH server now has the secret you used to authenticate with. Doesn't this introduce replay attacks where the SSH server can replay your ID Token to log into other SSH servers? Whereas if your ID Token functions like a "certificate" issued by your IDP b…
This is the purpose of the not so well known audience claim.
Though I'd still prefer to authenticate to something like Vault's SSH engine and get a very short lived SSH certificate instead. No new software to install on your servers, just the CA key.
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#43I don't love this. > Unfortunately, while ID Tokens do include identity claims like name, organization, and email address, they do not include the user’s public key. This prevents them from being used to directly secure protocols like SSH This seems like dubious statement. SSH authentication does not need to be key based. I understand the practicality of their approach, but I would have preferred this to be proper fi…
> This seems like dubious statement. SSH authentication does not need to be key based. Let's say you just use an ID Token as a bearer token to authenticate to SSH. The SSH server now has the secret you used to authenticate with. Doesn't this introduce replay attacks where the SSH server can replay your ID Token to log into other SSH servers? Whereas if your ID Token functions like a "certificate" issued by your IDP b…
I'd assume the auth handshake would prevent this.
- client connects to SSH server at IP X.X.X.X or hostname SomeHost
- redirected to oAuth server
- Client signs in and receives token scoped to X.X.X.X or hostname SomeHost
- Client provides token to SSH server
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#44Earlier quoted context omitted.
I gotta say, I love AuthorizedKeysCommand, it is the most clever configuration option I've seen in a protocol! If you just try to stuff a ID Token into an SSH key and use AuthorizedKeysCommands you introduce replay attacks because the SSH server can pull your ID Token out and stuff it into another SSH key and replay it to other SSH servers to impersonate you. Opkssh doesn't have this weakness because it used OpenPubk…
How does this prevent replay attacks, either by a malicious SSH server proxying the auth flow from another machine, or by a malicious server pulling out the signed IdP claims and passing them to another OpenID Connect target?
> a malicious server pulling out the signed IdP claims and passing them to another OpenID Connect target
The signed IdP claims aren't a secret. In OpenPubkey, they function like certificate for the user's public key. This makes them useless for replay attacks in opkssh.
The signed IdP claims are also scoped to a Client-ID specific for opkssh, so non-opkssh OpenID Connect services will reject them.
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#45Earlier quoted context omitted.
If you mention Kerberos to most "security" people these days they will think you're talking about Kubernetes.
really? that’s a shame kerberos is old and clunky but conceptually it got so much right. I’m so sick of the modern idea that i should wake up and babysit my machine through N different oauth dances to log in to all the services i need on a daily basis. once I authenticate once I should be implicitly authenticated everywhere.
That is one of the things that OIDC sorta almost never really managed to pull off consistently.
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#46[flagged]
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#47Earlier quoted context omitted.
Author of the blog here and main opkssh contributor. The title is wrong but this is OpenSSH and not a whole new implementation. opkssh uses the OpenSSH AuthorizedKeysCommand configuration option like AWS instance-connect to add OpenID Connect validation to OpenSSH authentication. ``` opkssh login ``` Generates a valid ssh key in `~/.ssh/` Then run bog standard ssh or sftp ``` ssh user@hostname ``` ssh will pull this…
I'm surprised it defaults to writing out key material into the filesystem[1] when SSH Agent has existed for quite a while. This use case seems especially relevant to sticking them in the agent given that (IIUC) these are short-lived certs anyway, so if your agent bounced you'd just get a fresh one without drama I do see https://github.com/openpubkey/opkssh/issues/6#issuecomment-2... > so I'm glad it's conceptually on…
Excellent point, SSH agent is a feature I've wanted to build for a while now but there was higher priority features. It will probably be included in the next major release. Would you put up for submitting it as a PR?
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#48Earlier quoted context omitted.
Author of the blog here and main opkssh contributor. The title is wrong but this is OpenSSH and not a whole new implementation. opkssh uses the OpenSSH AuthorizedKeysCommand configuration option like AWS instance-connect to add OpenID Connect validation to OpenSSH authentication. ``` opkssh login ``` Generates a valid ssh key in `~/.ssh/` Then run bog standard ssh or sftp ``` ssh user@hostname ``` ssh will pull this…
Just to make sure, opkssh supports OpenID for sftp as well?
It should, opkssh just creates ssh public keys. The integration tests don't current cover that case so I created an issue to add that to the integration tests:
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#49Earlier quoted context omitted.
I'm surprised it defaults to writing out key material into the filesystem[1] when SSH Agent has existed for quite a while. This use case seems especially relevant to sticking them in the agent given that (IIUC) these are short-lived certs anyway, so if your agent bounced you'd just get a fresh one without drama I do see https://github.com/openpubkey/opkssh/issues/6#issuecomment-2... > so I'm glad it's conceptually on…
Excellent point, SSH agent is a feature I've wanted to build for a while now but there was higher priority features. It will probably be included in the next major release. Would you put up for submitting it as a PR?
If I were still using SSH, maybe[1] but I'm thankful that I haven't used SSH in several years. I guess I also dodged a bullet by getting out before the Vault rug pull, since that would have made my life painful
1: although I don't think I'm the target audience for trail-blazing SSH auth; am a much, much bigger fan of just using X509 CA auth using short-term certs; it's much easier to reason about IMHO
Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
#50Author of the blog post and main opkssh contributor here, happy to answer any questions.
This is very interesting! It looks like there's a config file [1] to set up username Walking this through, given that OpenID Connect is specifically mentioned vs. bare OAuth2, I assume the ID token signatures are themselves verified by looking up ${ISSUER_URI}/.well-known/openid-configuration and following the jwks_uri found there. Is the JWKS response cached? Can it be pre-seeded and/or replaced with an offline copy?
[1]: https://github.com/openpubkey/opkssh/blob/main/README.md#etc...
[2]: https://github.com/openpubkey/opkssh/blob/main/README.md#etc...