141–150 of 156 posts
Earlier quoted context omitted.
ssh -k is too enterprise for ̶t̶e̶c̶h̶b̶r̶o̶ ̶s̶t̶a̶r̶t̶u̶p̶s̶ small companies that don't want to setup a kerberos realm
If you mention Kerberos to most "security" people these days they will think you're talking about Kubernetes.
I started building an alternative to SSH at https://terminalwire.com that I think is more suitable for one-off commands run on a developer workstation against a SaaS. In more concrete terms, think of the stripe, heroku, and GitHub CLIs. It’s similar to SSH in that it streams stdio from the server to a thin-client, but that’s where the similarities end. It has additional commands, like open a browser to a URL and set…
That's awesome. The web needs more terminal interfaces. What did you use to build that slick explainer video?
Earlier quoted context omitted.
Can you explain more? I want to be a fan of GSSAPI
Don't know what the grandparent meant by GSSAPI, that is just an API for various underlying auth methods. But what people usually use together with GSSAPI is Kerberos. Kerberos can be very secure, much more so than CA-based or generally asymmetric crypto based approaches. Kerberos (if you ignore some extensions) uses symmetric cryptography, so it is less vulnerable to quantum computers. Use AES256 and you are fine, a…
Due to an incredible bloat of AD and entire Windows/Azure ecosystem, it has an enormous attack surface (multiply the universe of all windows ecosystem by the decades of old versions being supported for compatibility), and any vulnerability in the ecosystem (past and present) can lead to escalation and compromise of the Active Directory itself.
so is Kerberos secure? as a protocol it is fine, cause it was developed at MIT by smart people.
is MSFT AD/Windows ecosystem secure? HELL NO, stay away
Earlier quoted context omitted.
Years ago, I tried building something like this using ProxyCommand to try to fetch the SSH certificate "just-in-time" without having to run a command first, but unfortunately the ordering of OpenSSH was such that ProxyCommand ran after checking the disk for SSH certs/keys. :(
You could use `host match exec` instead of `ProxyCommand`. I believe it will run before you end up checking for files on disk.
Earlier quoted context omitted.
That's awesome. The web needs more terminal interfaces. What did you use to build that slick explainer video?
Screen Studio for macOS
I've been looking for something to record demos of opkssh. What I have now isn't cutting it.
Earlier quoted context omitted.
Excellent point, SSH agent is a feature I've wanted to build for a while now but there was higher priority features. It will probably be included in the next major release. Would you put up for submitting it as a PR?
That sounds like an interesting feature to write. Is there an open issue for it?
"Key management improvements on the client and SSH agent support": https://github.com/openpubkey/opkssh/issues/6#issuecomment-2...
Earlier quoted context omitted.
Screen Studio for macOS
Do you recommend it? How easy is it to edit videos and add overlays and images? I've been looking for something to record demos of opkssh. What I have now isn't cutting it.
Earlier quoted context omitted.
> It’s been possible since openid connect was invented. It has been possible since OpenID Connect was invented but figuring out how to get a public key into an ID Token without having to update IDPs or change the protocol in anyway was not known until we published OpenPubkey[0]. OpenID Connect was not designed to do this. Figuring out how to smuggle this additional information into OpenSSH without requiring code chan…
I didn’t mean to downplay the amount of work involved. It’s just that it feels to me like the ‘solution’ to problems like these seem very simple when that work has been put in. It’s just that nobody really wants to (OpenID connect became a lot easier to understand when I read the spec, but I never got anywhere close to enjoying it), hence, we didn’t have this until now.
I like that they used (and abused) standard ssh server features to implement this. Is anybody aware of something like this that can be automated for things like ansible or see a way to use this there?
Doesn't ansible already get you all of this? What is the feature gap you are looking to fill?
That said you definitely use opkssh in automation. OpenPubkey already supports the github-action and gitlab-CI OpenID Providers so in theory you could use opkssh to let a github-action or gitlab-CI workflow ssh into servers under that workflows identity. That is, have a policy on your SSH server that allows only "workflows from repo X triggered by a merge into main ...".
Additionally you can always do machine-identity using OpenID Connect either by running your own JWKS server.
While this works in OpenPubkey, we haven't added this to opkssh yet but we have an issue for it. If you want support for this add your usecase as a comment
Earlier quoted context omitted.
You could use `host match exec` instead of `ProxyCommand`. I believe it will run before you end up checking for files on disk.
Hey, thanks for that! I didn't come across that back then. Looks intriguing.