This post inspired me to add SSH host key signing to WeEncrypt (formerly LessEncrypt): https://github.com/linsomniac/weencrypt
SSH certificates: the better SSH experience
131–137 of 137 posts
Re: SSH certificates: the better SSH experience
#132Earlier quoted context omitted.
If you mean using OIDC, in that space there's at least https://github.com/EOSC-synergy/ssh-oidc , https://dianagudu.github.io/mccli/ and OpenPubkey-ssh discussed in https://news.ycombinator.com/item?id=43470906 (which might mention more). How does SSSD support help with SSH authN? I know you can now get Kerberos tickets from FreeIPA using OIDC(?), but I forget if SSSD is involved.
I haven't used SSSD due it not being available for Alpine but doesn't it provide authentication via pam_sss ?
Yes, but its authN components only act locally, and PAM is optional for sshd. It can/does call out to network services like Kerberos/LDAP given a password, of course, but I was thinking of network authN connected directly with OIDC somehow, for which I don't know a mechanism in vanilla OpenSSH. (I don't know what Authentik does for this -- I could imagine it's behind the scenes somehow.) I should probably look it up sometime.
Re: SSH certificates: the better SSH experience
#133The author lists all the advantes of CA certificates, yet doesn't list the disadvantages. OTOH, all the many steps required to set it up make the disadvantages rather obvious. Also, I've never had a security issue due to TOFU, have you?
> Also, I've never had a security issue due to TOFU, have you? You haven't yet had a security issue due to TOFU - FTFY.
Who knows - maybe I'll never have one until I stop using TOFU.
Re: SSH certificates: the better SSH experience
#134Earlier quoted context omitted.
I haven't used SSSD due it not being available for Alpine but doesn't it provide authentication via pam_sss ?
Yes, but its authN components only act locally, and PAM is optional for sshd. It can/does call out to network services like Kerberos/LDAP given a password, of course, but I was thinking of network authN connected directly with OIDC somehow, for which I don't know a mechanism in vanilla OpenSSH. (I don't know what Authentik does for this -- I could imagine it's behind the scenes somehow.) I should probably look it up…
My understanding is since it's an agent running on the target, possibilities will be quite extensive. But it is relatively new and there is no stable release of it yet.
https://docs.goauthentik.io/endpoint-devices/authentik-agent...
Re: SSH certificates: the better SSH experience
#135Earlier quoted context omitted.
I'm consistently amazed how many developers and security professionals don't have a clear understanding how PPK even works conceptually. Things like deploying dev keys to various production environments, instead of generating/registering them within said environment. One of the worst recent security examples... You can't get this data over HTTPS from $OtherAgency, it's "not secure" ... then their suggestion is a "sec…
Or when the security team at some other company emails you their private key.
LOL, yeah.. had that happen quite a few times... Also, re-using the ssh server key for the client connecting to the sftp server.
Re: SSH certificates: the better SSH experience
#136Earlier quoted context omitted.
I'm consistently amazed how many developers and security professionals don't have a clear understanding how PPK even works conceptually. Things like deploying dev keys to various production environments, instead of generating/registering them within said environment. One of the worst recent security examples... You can't get this data over HTTPS from $OtherAgency, it's "not secure" ... then their suggestion is a "sec…
> Things like deploying dev keys to various production environments, instead of generating/registering them within said environment. I can see this happening when a developer is authorized to generate, but not to register. So, they just reuse an already-registered one.
In the example, it wasn't even that complex... I have used patterns to register allowed signer keys based on environment variables that an application runs under, initializing at startup... so "register" just meant assigning the correct values for 2-4 environment variables per public signer allowed... and removing the dev signer. (JWT based auth)
Re: SSH certificates: the better SSH experience
#137With the recent wave of npm hacks stealing private keys, I wanted to limit key's lifetimes. I've set up a couple of yubikeys as SSH CAs on hosts I manage. I use them to create short lived certs (say 24h) at the start of the day. This way i only have to enter the yubikey pin once a day. I could not find an easy way to limit maximum certificate lifetime in openssh, except for using the AuthorizedPrincipalCommand, which…
In addition to ssh key, I have my servers also ask for a one-time password