Using certificates for SSH authentication [LWN.net]

Using certificates for SSH authentication

Posted Nov 9, 2022 21:27 UTC (Wed) by amarao (guest, #87073)
Parent article: Using certificates for SSH authentication

We use them, but the next thing with certificate, is desire to create user on first login with signed key. Unfortunately, it's not possible now, which is a big bummer. You need to enroll each user on each sever, or use one user for all users.

to post comments

Using certificates for SSH authentication

Posted Nov 9, 2022 21:49 UTC (Wed) by mjg59 (subscriber, #23239) [Link] (2 responses)

You can use AuthorizedPrincipalsCommand for this, with a bootstrap user - when a user tries to log in as the bootstrap user, extract the user principal from the certificate, create the user, and then exit. The user can now log in. It's a little cumbersome, but it works.

Using certificates for SSH authentication

Posted Nov 9, 2022 21:58 UTC (Wed) by amarao (guest, #87073) [Link] (1 responses)

We've tried. It doesn't work. Ssh consults pam for user existence at key validation time. No user, no auth.

Using certificates for SSH authentication

Posted Nov 9, 2022 22:33 UTC (Wed) by mjg59 (subscriber, #23239) [Link]

Right. You need a separate bootstrap user (which actually exists) to trigger user creation. It's a somewhat clumsy solution, but it avoids needing to pre-create every user everywhere.

Using certificates for SSH authentication

Posted Nov 9, 2022 22:07 UTC (Wed) by unBrice (subscriber, #72229) [Link] (2 responses)

I think you should be able to provision them dynamically with a custom AuthorizedPrincipalsCommand, no? Google (Disclaimer: my employer) uses a custom AuthorizedPrincipalsCommand to allow limiting the scope of a user key without needing to provision a certificate for each machine. This is a slightly different problem but a related one. Code is on GitHub

Using certificates for SSH authentication

Posted Nov 9, 2022 22:13 UTC (Wed) by amarao (guest, #87073) [Link] (1 responses)

Yes, it was my expectations too. The problem is that without existing user it's not possible to authorize it, therefore there is no AuthorizedPrincipalCommand run.

There is a pam module to autocreate user on check, but it's creating random users under Chinese bot scans.

Using certificates for SSH authentication

Posted Nov 10, 2022 12:22 UTC (Thu) by bof (subscriber, #110741) [Link]

Who forces you to allow chinese bots to scan your machines in the first place?

... and now we come to the point of how to distribute ipsets with known-good source IPs securely around the places we care about :-)