Using certificates for SSH authentication [LWN.net]

Using certificates for SSH authentication

Posted Nov 8, 2022 18:19 UTC (Tue) by Cyberax (✭ supporter ✭, #52523)
Parent article: Using certificates for SSH authentication

One thing that is really interesting is that you can use very short-lived certificates produced by your organization's single-sign-on system. This way you can avoid any static credentials on developers' machines.

to post comments

Using certificates for SSH authentication

Posted Nov 8, 2022 19:25 UTC (Tue) by joib (subscriber, #8541) [Link] (2 responses)

There are a couple of commercial/open core projects that do this, teleport and smallstep come to mind. I think hashicorp vault also has something related to ssh cert management.

Using certificates for SSH authentication

Posted Nov 8, 2022 20:37 UTC (Tue) by Cyberax (✭ supporter ✭, #52523) [Link]

Uber has open-sourced its version: https://medium.com/uber-security-privacy/introducing-the-...

We have our own version that I hope to push to open source, but it's typically very tied to the company's infrastructure.

Using certificates for SSH authentication

Posted Nov 11, 2022 21:35 UTC (Fri) by dbnichol (subscriber, #39622) [Link]

Indeed Vault does - https://developer.hashicorp.com/vault/docs/secrets/ssh/si.... I've never used that engine, but we use it for lots of other things. Since it also has a wide variety of authentication methods, you can configure it in a way that fits your organization.

Using certificates for SSH authentication

Posted Nov 9, 2022 9:55 UTC (Wed) by grawity (subscriber, #80596) [Link] (3 responses)

I've always thought that such systems just reinvent Kerberos (which SSH has supported for quite a while now). Is there a specific advantage in using SSH certificates instead?

Using certificates for SSH authentication

Posted Nov 9, 2022 10:10 UTC (Wed) by anselm (subscriber, #2796) [Link]

You can do without the inconvenience and expense of setting up and maintaining a Kerberos infrastructure.

Using certificates for SSH authentication

Posted Nov 9, 2022 15:58 UTC (Wed) by Cyberax (✭ supporter ✭, #52523) [Link] (1 responses)

Anything that uses a trusted third party to produce and validate authentication tokens looks like Kerberos.

Kerberos is something that JustDoesn'tWork(tm). Quite simply. It can go wrong in many, many different ways that are impossible to debug. For example, I once spent a week debugging Putty only to find out that it linked with Heimdall Kerberos libraries instead of MIT Kerberos.

And Kerberos is also very hard to set up. And there's also very little support for 2FA in common tools like kinit. Etc.

Additionally, Kerberos requires constant connection to the KDC, while SSH CAs just need to be able to put the CA root certificate on machines once (it can even be baked-in during the image creation). You don't need to enroll instances individually (although it might be a good idea, for machine certs).

Using certificates for SSH authentication

Posted Nov 9, 2022 22:19 UTC (Wed) by AdamW (subscriber, #48457) [Link]

There's always FreeIPA, which handles most of the kerberos messiness for you and provides a lot of handy stuff around it.