|
|
Log in / Subscribe / Register

Using certificates for SSH authentication

Using certificates for SSH authentication

Posted Nov 15, 2022 16:46 UTC (Tue) by anton (subscriber, #25547)
In reply to: Using certificates for SSH authentication by tilt12345678
Parent article: Using certificates for SSH authentication

“An SSH public key does not specify which host or user it belongs to, for example, whereas a certificate has a list of "principals" that it vouches for. A principal is a host or user name.”

I fail to find this disclosure desirable.

Apparently neither do the OpenSSH maintainers. I have old user public keys that contain username@hostname (which is helpful when weeding out authorized_keys files), and old entries in known_hosts files that contain the FQDN and IP of the host. That's gone or (for known_hosts) encrypted in newer public keys and known_hosts entries.

Makes me wonder if the reasons why they were eliminated also hold for certificates. I guess that in the presence of certificate servers one would need to encrypt the public keys in the files, otherwise one could recreate the information that were intentionally left away from these files by looking the public keys up in a certificate server.

to post comments

Using certificates for SSH authentication

Posted Nov 19, 2022 2:27 UTC (Sat) by rra (subscriber, #99804) [Link]

Hostnames in known_hosts files were hashed because they were widely used by attackers to build target lists of places where the credentials they just stole were likely to work. I would argue that it's security via obscurity, not a real security control, but it does tend to slow them down.

If you prefer the format without the hashing, you can turn it off in your config (HashKnownHosts).


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds