LWN: Comments on "What's new in OpenSSH 6.2"

What's new in OpenSSH 6.2

dugsong — Fri, 16 Aug 2013 03:58:14 +0000

We implemented a native kbdint driver for Duo Security's two-factor authentication for OpenSSH ("keyboard-interactive:duo"), coordinated with markus' AuthenticationMethods submethod commit. Code and docs here:

https://github.com/duosecurity/libduo/tree/master/openssh

A similar experience can be achieved using our ForceCommand trick, which doesn't require any sshd changes or root access:

https://blog.duosecurity.com/2011/04/ssh-keys-that-call-y...

But the latter approach doesn't prevent port forwarding before secondary authentication.

What's new in OpenSSH 6.2

nix — Wed, 03 Apr 2013 15:01:31 +0000

OK. On further investigation, if you are using PAM, then the password authentication method will always use it -- but if you're using keyboard-interactive, then (as the default config file somewhat confusingly suggests, without mentioning keyboard-interactive at all) PAM's account and session checks will run but PAM will not be given the opportunity to actually ask you for a password. The advantage of all this over turning on PasswordAuthentication is... somewhat opaque to me. I guess keyboard-interactive can be used for more intricate protocols, but none appear to exist other than S/Key yet, and it doesn't seem likely that many will be added as long as PAM exists, since PAM is useful for lots of non-ssh uses as well.

What's new in OpenSSH 6.2

nix — Wed, 03 Apr 2013 14:24:16 +0000

Hm, is there any evidence that specifying submethods after a colon works? I can't see an implementation of that in the code, it's not documented in the manpage, and trying to use it gives

error: Unknown authentication method "keyboard-interactive:pam" in list
fatal: reprocess config line 105: invalid authentication method list.

which seems pretty conclusive.

(FWIW, the undocumented keyword KbdInteractiveAuthentication yes" might also be necessary. It is documented as working in Match blocks but is nowhere else documented. Its default value appears to be 0, which is hard to square with keyboard-interactive authentication apparently working when password auth is turned on. Maybe PAM is a kind of password auth? The difference between password and keyboard-interactive is extremely opaque to me.)

What's new in OpenSSH 6.2

nix — Thu, 28 Mar 2013 16:07:05 +0000

AuthenticationMethods is awesome, of course, and has on its own got me to splash out on a Yubikey, now that I can use it in combination with challenge-response authentication. But the really interesting thing, I think, is KRLs. Now it becomes clear just why someone might want to use certificates rather than straight keys... there's no equivalent for straight keys of zapping certificates by serial number, nor could there be.