Poll HN: Do you use SSH certificates (not mere public-key authentication)? • Hacker News Board

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#151

Post by gunapologist99 » Fri, Sep 02, 2022, 3:18 AM UTC

tptacek wrote: post #116

gunapologist99 wrote: post #112

Earlier quoted context omitted.

Sarcastic remarks like "if [mostly good things] aren't principles for your security practice" an strawman arguments seem a bit provocative for this type of debate.

There was absolutely nothing sarcastic about that remark. I wouldn't snark at 'jerf. Most security practices don't have those principles for SSH. Thanks for calling it out though; if you read it that way, they might have too, which would be a little mortifying.

That's fair. thanks for the clarification!

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#152

Post by egberts1 » Fri, Sep 02, 2022, 4:53 AM UTC

dotwaffle wrote: post #138

egberts1 wrote: post #113

Earlier quoted context omitted.

Yes. Hesiod is safer than DNS TXT once secured by DNSSEC, because I envision mass blocking of DNS TXT in the near future.

Good luck with that. DNS TXT records are used for a lot of infrastructure right now, from DMARC/SPF/DKIM to DNS-01 validation through LetsEncrypt afaik.

Yes, and that too will change … again.

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#153

Post by cubesnooper » Fri, Sep 02, 2022, 6:18 AM UTC

goodpoint wrote: post #142

cubesnooper wrote: post #125

Earlier quoted context omitted.

> How is this more secure than simply creating new certificates and replacing the old ones is the authorized_keys files? It’s more convenient for me than updating authorized_keys. When I build a new machine, for example, I first generate a new SSH keypair on the machine. Then I copy the server and user public keys to the CA. Once I drop them in the right folder, certificates get generated automatically and served ove…

How do you implement emergency certificate revocation?

I have another Raspberry Pi sitting next to my desk, with a keyboard and a tiny screen, dedicated to systems administration. My user on this machine has an SSH key that on every machine logs into an account with sudo access. To revoke a user key, I run a script from this machine that logs into each host and updates sshd’s RevokedKeys.

I have no mechanism at the moment for revoking host keys, which is a harder problem to solve as it would involve updating a number of laptops, phones, etc. that may not be powered on at a given time, but that’s less of a problem since if I knew a host key had been compromised I wouldn’t be logging into it anyway.

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#154

Post by xorcist » Fri, Sep 02, 2022, 11:50 AM UTC

dcow wrote: post #70

cubesnooper wrote: post #66

Earlier quoted context omitted.

You’re thinking of known_hosts, not authorized_keys.

You are right, I am. Now I understand the DNSSEC setup.

Known_hosts can also be put in DNSSEC, using the SSHFP DNS record. OpenSSH understands that out of the box.

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#155

Post by xorcist » Fri, Sep 02, 2022, 11:53 AM UTC

bongobingo1 wrote: post #140

chociej wrote: post #111

Earlier quoted context omitted.

You could simply choose a short TTL, or your tool could check for e.g. "some-name._sshkeys.whatever.tld" as well as "_revoked.some-name._sshkeys.whatever.tld" to handle revocation instantly

You could also just stick it behind a https GET and probably skip a bunch of bother.

Now you've just moved your authentication to the SSL PKI.

In that case, use the SSL certs directly. You'd have add support OpenSSH of course, or just convert the certificates to SSH format, but it would be architecturally much simpler.

As to the original question here, the benefit compared to other PKI alternatives (including the SSH PKI in the original question) is that revocation is much easier.

Re: Poll HN: Do you use SSH certificates (not mere public-key authentication)?

#156

Post by goodpoint » Tue, Sep 06, 2022, 4:22 PM UTC

cubesnooper wrote: post #153

goodpoint wrote: post #142

Earlier quoted context omitted.

How do you implement emergency certificate revocation?

I have another Raspberry Pi sitting next to my desk, with a keyboard and a tiny screen, dedicated to systems administration. My user on this machine has an SSH key that on every machine logs into an account with sudo access. To revoke a user key, I run a script from this machine that logs into each host and updates sshd’s RevokedKeys. I have no mechanism at the moment for revoking host keys, which is a harder problem…

If you still have a device that can log into every system as root what's the security benefit of a CA?

Now you have two critical systems to protect instead of one: the Raspberry Pi and the CA.