Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

blog.cloudflare.com

Post reply on HN
Print view View original

151–156 of 156 posts

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#151

Post by cjcampbell »

Definitely interested to kick the tires and compare to some of the other solutions out there. As others mentioned, you lose some benefits of an OIDC-integrated SSH CA, but that’s a reasonable trade off in order to reduce complexity for many use cases.

A missing piece of the puzzle for me is general OSS tooling to provision the Linux OS users. While it works in some environments to grant multiple parties access to the same underlying OS users, it’s necessary (or at least easier) in others to have users accessed named user accounts.

Step-ca makes good use of NSS/PAM to make this seamless when attached to a smallstep account (which can be backed by an IdP and provisioned through SCIM). While I could stand up LDAP to accommodate this use case, I’d love a lightweight way for a couple of servers to source users directly from the most popular IdP APIs. I get by with a script that syncs a group every N minutes. And while that’s more than sufficient for a couple of these use cases, I’ll own up to wanting the shiny thing and the same elegance of step-ca’s tooling.

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#152

Post by thyristan »

slt2021 wrote: post #143
thyristan wrote: post #131

Earlier quoted context omitted.

Don't know what the grandparent meant by GSSAPI, that is just an API for various underlying auth methods. But what people usually use together with GSSAPI is Kerberos. Kerberos can be very secure, much more so than CA-based or generally asymmetric crypto based approaches. Kerberos (if you ignore some extensions) uses symmetric cryptography, so it is less vulnerable to quantum computers. Use AES256 and you are fine, a…

the weak point of Kerberos is not the Kerberos protocol itself, but the most popular implementation of it being Microsoft Active Directory. Due to an incredible bloat of AD and entire Windows/Azure ecosystem, it has an enormous attack surface (multiply the universe of all windows ecosystem by the decades of old versions being supported for compatibility), and any vulnerability in the ecosystem (past and present) can…

Well, yes, almost totally in agreement, but: MIT Kerberos (the implementation) started out as "research-quality" code of the 1990s era. It has improved, it fares far better than AD, but the occasional exploits still continue to drop.

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=kerberos

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#153

Post by radlad »

cjcampbell wrote: post #150
radlad wrote: post #144

Earlier quoted context omitted.

Hey, thanks for that! I didn't come across that back then. Looks intriguing.

I’ve played a bit with this, but iirc, I ran into limitations with some of the clients that needed to be supported. But if all you need is OpenSSH, you should be set.

Good call out. One of the advantages of ProxyCommand was that it is supported by Chrome's Secure Shell extension, meaning you could use it on Chromebooks: https://chromewebstore.google.com/detail/secure-shell/iodiha...

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#154

Post by pluto_modadic »

megous wrote: post #84
lxgr wrote: post #54

Earlier quoted context omitted.

I suppose you could do something based on IDP-signed tokens, e.g. "valid for authentication to service x until "?

This is basically a ssh certificate then.

the difference is in /key management/. Key management is the hard part. Especially keyless SSH management. (things like sigstore's rekor/fulcio remove some complexity here). It is not "just a (manually generated) ssh certificate"

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#155

Post by dizhn »

EthanHeilman wrote: post #149
dizhn wrote: post #129

I like that they used (and abused) standard ssh server features to implement this. Is anybody aware of something like this that can be automated for things like ansible or see a way to use this there?

> Is anybody aware of something like this that can be automated for things like ansible Doesn't ansible already get you all of this? What is the feature gap you are looking to fill? That said you definitely use opkssh in automation. OpenPubkey already supports the github-action and gitlab-CI OpenID Providers so in theory you could use opkssh to let a github-action or gitlab-CI workflow ssh into servers under that wor…

As far as I understand, this solution requires interactive authentication first, i.e it brings up the idp login page then issues the required keys etc. I was asking about whether there's a way to automate this such that one can use a static token, or a machine key etc. This way you could still benefit from rotating the key, cancelling a user's access etc. I believe this is what sssd can do today except it doesn't work on musl based distros.

Re: Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

#156

Post by EthanHeilman »

zaat wrote: post #18
EthanHeilman wrote: post #8

Earlier quoted context omitted.

Author of the blog here and main opkssh contributor. The title is wrong but this is OpenSSH and not a whole new implementation. opkssh uses the OpenSSH AuthorizedKeysCommand configuration option like AWS instance-connect to add OpenID Connect validation to OpenSSH authentication. ``` opkssh login ``` Generates a valid ssh key in `~/.ssh/` Then run bog standard ssh or sftp ``` ssh user@hostname ``` ssh will pull this…

Just to make sure, opkssh supports OpenID for sftp as well?

Tested sftp works and created an integration test for sftp
Post reply on HN