Using certificates for SSH authentication [LWN.net]

Using certificates for SSH authentication

Posted Nov 17, 2022 12:58 UTC (Thu) by zwol (guest, #126152)
In reply to: Using certificates for SSH authentication by cortana
Parent article: Using certificates for SSH authentication

* There is no way (AFAICT) to use an SSH key as the credential with which to request a TGT. You're stuck using a passphrase for the initial authentication process. This is a UX friction point for anyone who has to work with remote hosts managed via Kerberos *and* remote hosts managed via .ssh/authorized_keys -- your ssh-agent does you no good for the former and your local Kerberos tickets do you no good for the latter. And since all the big cloud code hosters are in the latter category for "git push", this in turn means *any Kerberized organization* is probably caught in this irritating catch-22.

to post comments

Using certificates for SSH authentication

Posted Nov 19, 2022 2:23 UTC (Sat) by rra (subscriber, #99804) [Link]

> There is no way (AFAICT) to use an SSH key as the credential with which to request a TGT.

Not out of the box but it's not particularly difficult to write. I did so at my previous job. Conceptually, it's just a simple ssh forced-command wrapper around kinit against the KDC as the backing store and then returning the resulting TGT for storage in a ticket cache. Maybe a week or two of work.

The hard part in all of these systems isn't the protocols, it's your chain of trust for how you get keys to users, manage them, and revoke them when necessary.