Using certificates for SSH authentication [LWN.net]

Using certificates for SSH authentication

Posted Nov 9, 2022 22:07 UTC (Wed) by unBrice (subscriber, #72229)
In reply to: Using certificates for SSH authentication by amarao
Parent article: Using certificates for SSH authentication

I think you should be able to provision them dynamically with a custom AuthorizedPrincipalsCommand, no? Google (Disclaimer: my employer) uses a custom AuthorizedPrincipalsCommand to allow limiting the scope of a user key without needing to provision a certificate for each machine. This is a slightly different problem but a related one. Code is on GitHub

to post comments

Using certificates for SSH authentication

Posted Nov 9, 2022 22:13 UTC (Wed) by amarao (guest, #87073) [Link] (1 responses)

Yes, it was my expectations too. The problem is that without existing user it's not possible to authorize it, therefore there is no AuthorizedPrincipalCommand run.

There is a pam module to autocreate user on check, but it's creating random users under Chinese bot scans.

Using certificates for SSH authentication

Posted Nov 10, 2022 12:22 UTC (Thu) by bof (subscriber, #110741) [Link]

Who forces you to allow chinese bots to scan your machines in the first place?

... and now we come to the point of how to distribute ipsets with known-good source IPs securely around the places we care about :-)