4 ms·
Have a look at eg: https://linux-audit.com/granting-temporary-access-to-servers-using-signed-ssh-keys/ https://linux-audit.com/granting-temporary-access-to-ser
by e12e 8y ago
Have a look at eg:
https://linux-audit.com/granting-temporary-access-to-servers-using-signed-ssh-keys/ https://linux-audit.com/granting-temporary-access-to-servers...
And re-read the (imnho rather obtuse) ssh-keygen man pages.
[ed: and maybe this too:
https://framkant.org/2017/07/scalable-access-control-using-openssh-certificates/ https://framkant.org/2017/07/scalable-access-control-using-o...
]
- otterley 8y agoThanks! So it looks like AuthorizedPrincipalsFile/AuthorizedPrincipalsCommand gives us a method for doing this. This would have to be combined with some sort of user ID management system still, like distribution of /etc/{passwd,group} files, LDAP/AD, etc.
- e12e 8y agoThere's also: https://github.com/uber/pam-ussh/blob/master/README.md https://github.com/uber/pam-ussh/blob/master/README.md https://medium.com/uber-security-privacy/introducing-the-uber-ssh-certificate-authority-4f840839c5cc https://medium.com/uber-security-privacy/introducing-the-ube... And for the ssh ca part, bless and teleport (as others have mentioned). There's the option of putting stuff in ad/ldap - but if you're already using ad, kerberized ssh (and sudo etc) might be the way to go. I like the idea of a system that's simpler than ad/ldap+kerberos - and ssh certs fits most of the bill. The challenge becomes auth/authz beyond just login - ldap basically requires ssl ca anyway - and at that point, especially with kerberos set up - I think one might be better off sticking with one complex auth/authz system rather than two... At least it should be possible to avoid passwords with something like: https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-Proxy https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-...