Using certificates for SSH authentication [LWN.net]

Using certificates for SSH authentication

Posted Nov 9, 2022 9:55 UTC (Wed) by grawity (subscriber, #80596)
In reply to: Using certificates for SSH authentication by Cyberax
Parent article: Using certificates for SSH authentication

I've always thought that such systems just reinvent Kerberos (which SSH has supported for quite a while now). Is there a specific advantage in using SSH certificates instead?

Using certificates for SSH authentication

Posted Nov 9, 2022 15:58 UTC (Wed) by Cyberax (✭ supporter ✭, #52523) [Link] (1 responses)

Anything that uses a trusted third party to produce and validate authentication tokens looks like Kerberos.

Kerberos is something that JustDoesn'tWork(tm). Quite simply. It can go wrong in many, many different ways that are impossible to debug. For example, I once spent a week debugging Putty only to find out that it linked with Heimdall Kerberos libraries instead of MIT Kerberos.

And Kerberos is also very hard to set up. And there's also very little support for 2FA in common tools like kinit. Etc.

Additionally, Kerberos requires constant connection to the KDC, while SSH CAs just need to be able to put the CA root certificate on machines once (it can even be baked-in during the image creation). You don't need to enroll instances individually (although it might be a good idea, for machine certs).

Using certificates for SSH authentication

Posted Nov 9, 2022 22:19 UTC (Wed) by AdamW (subscriber, #48457) [Link]

There's always FreeIPA, which handles most of the kerberos messiness for you and provides a lot of handy stuff around it.