4 ms·

One thing I like to do with the SSH Agent is also forward my X.509 certificates by adding new opcodes to the SSH Agent protocol, then you can do stuff like PKCS

One thing I like to do with the SSH Agent is also forward my X.509 certificates by adding new opcodes to the SSH Agent protocol, then you can do stuff like PKCS#11 on the remote side with your local smartcard. [0] This gives you, among other things, passwordless but authenticated "sudo" capability (which is actually required by the DOD, though nobody does it). [0] http://cackey.rkeene.org/fossil/artifact/0d0e90bbfdee672c?ln=296-312%20481-482%20561-563%20573-576 http://cackey.rkeene.org/fossil/artifact/0d0e90bbfdee672c?ln...

rkeene2 6y ago
Forgot to include a link the PKCS#11 module which talks to the SSH Agent: [0] [0] https://chiselapp.com/user/rkeene/repository/ssh-agent-pkcs11/dir?ci=trunk https://chiselapp.com/user/rkeene/repository/ssh-agent-pkcs1...
closeparen 6y ago
Are you aware of any hardware tokens that support PKCS#11 and can be implemented affordably at small scale? The only ones I've found are Yubikey, but Yubikey's other protocols (OTP, U2F) are a lot simpler to implement, so I've never tried. At one point I bought a few literal smart cards and a USB reader, but not being an enterprise customer of any of the vendors, couldn't find the necessary drivers / passwords to get them working with PKCS#11.
- count 6y ago
  It's not 'simple', but it's definitely doable with Yubikey: https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PKCS11.html https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK... I've used it on macOS to use a PIV cert on a yubikey to ssh to remote linux servers. I have NOT used it to ssh-agent chain through, jump-box style though.
  - closeparen 6y ago
    If you're already bound to Yubikey, though, any advantage to PKCS#11 over OTP? Theoretically it's an open standard, but there seems to be only one real vendor.
    - Disposition 6y ago
      PKCS#11 is extremely versatile, with some configuration you can use Yubikey PIV X.509 keys to authenticate SSH sessions by passing the necessary pkcs11 lib to ssh with the -I flag. PKCS#11 isolates the key signing from the PC by doing any private key computation operations on the secure element, this prevents leakage of the private key by traditional means. Browser TLS client authentication is also possible with some minimal initial setup of your browser of choice. You can use openssl with a pkcs11 engine for any X.509 operations you might think of (e.g. PKI, S/MIME email signing, etc.)—technically you could use the PIV applet to store web server TLS keys and have Nginx use those through OpenSSL via the pkcs11 engine, though it would probably slow down handshaking as the throughput and signing speed of a Yubikey is orders of magnitude slower than any modern general purpose CPU. Many people don't know that Yubikeys also run a OpenPGP card applet for storing up to 3 key pairs. With the ssh option of gpg-agent it can also be used for SSH authentication just like ssh-agent. I use this in combination with a Yubikey configuration setting requiring all GPG sign operations to be confirmed within 10 seconds by pressing the capacitive touch button on my YK4 nano (LED blinks during this time to prompt). This way I can safely enable agent forwarding globally as all SSH session authentication requires physical interaction to confirm (provided you don't have any file-based keys in the same agent which are still vulnerable to usage without your knowledge via this functionality).
      - count 6y ago
        I use the gpg-agent option as well, but hate it (GPG makes me feel icky). That is not, as I understand it, using an X.509 key for authentication though. Which is what I'd like (ssh-agent forward an X.509 based auth mechanism - like remote PKCS#11 over that agent connection, so the key stays on my yubi, and I only need CA certs on the remote hosts.
        6y ago
- rkeene2 6y ago
  If you're going the Smart card route you can get the PIVKey C910 on Amazon for $15/ea. in quantities of 1. You can also buy them for about $0.10/ea on AliExpress, and then load CoolKey or some other applet.
  - closeparen 6y ago
    >Platform Support >Windows In-Box PIV Driver (Read Only) and PIVkey Windows Minidriver (Read/Write): Windows Vista, 7, 8, Server 2003, Server 2008, Server 2012. >Mac OSX, Linux and Android (Read Only - Middleware Required) The only open source middleware I know of for OSX is OpenSC, and it doesn't list C910 as a supported card. https://github.com/OpenSC/OpenSC/wiki/Supported-hardware-(smart-cards-and-USB-tokens) https://github.com/OpenSC/OpenSC/wiki/Supported-hardware-(sm...
    - rkeene2 6y ago
      The PIVKey C910 complies with NIST SP-800-73 (PIV) -- same as YubiKey PIV mode, so OpenSC supports it. Also, the middleware I wrote (CACKey) is open source and supports it and works on macOS as a tokend driver.
    - rkeene2 6y ago
      I forgot to mention that also, of course, CoolKey is open source and the CoolKey PKCS#11 module supports the CoolKey applet (obviously) and makes some attempts to support the US DOD CAC and the US Government PIV -- though I don't know how successful they are. Bugs and feature limitations in CoolKey led me to write CACKey.
      - closeparen 6y ago
        Coolkey is trying to link OSX 10.5 libraries and cross-compile for PowerPC. Seems like abandonware. Are you using it successfully in 2020?
        rkeene2 6y ago
        I mostly use CACKey, since I wrote it to replace CoolKey for my needs.

rkeene2 6y ago

Forgot to include a link the PKCS#11 module which talks to the SSH Agent: [0] [0] https://chiselapp.com/user/rkeene/repository/ssh-agent-pkcs11/dir?ci=trunk https://chiselapp.com/user/rkeene/repository/ssh-agent-pkcs1...

closeparen 6y ago

Are you aware of any hardware tokens that support PKCS#11 and can be implemented affordably at small scale? The only ones I've found are Yubikey, but Yubikey's other protocols (OTP, U2F) are a lot simpler to implement, so I've never tried. At one point I bought a few literal smart cards and a USB reader, but not being an enterprise customer of any of the vendors, couldn't find the necessary drivers / passwords to get them working with PKCS#11.

count 6y ago
It's not 'simple', but it's definitely doable with Yubikey: https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PKCS11.html https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK... I've used it on macOS to use a PIV cert on a yubikey to ssh to remote linux servers. I have NOT used it to ssh-agent chain through, jump-box style though.
- closeparen 6y ago
  If you're already bound to Yubikey, though, any advantage to PKCS#11 over OTP? Theoretically it's an open standard, but there seems to be only one real vendor.
  - Disposition 6y ago
    PKCS#11 is extremely versatile, with some configuration you can use Yubikey PIV X.509 keys to authenticate SSH sessions by passing the necessary pkcs11 lib to ssh with the -I flag. PKCS#11 isolates the key signing from the PC by doing any private key computation operations on the secure element, this prevents leakage of the private key by traditional means. Browser TLS client authentication is also possible with some minimal initial setup of your browser of choice. You can use openssl with a pkcs11 engine for any X.509 operations you might think of (e.g. PKI, S/MIME email signing, etc.)—technically you could use the PIV applet to store web server TLS keys and have Nginx use those through OpenSSL via the pkcs11 engine, though it would probably slow down handshaking as the throughput and signing speed of a Yubikey is orders of magnitude slower than any modern general purpose CPU. Many people don't know that Yubikeys also run a OpenPGP card applet for storing up to 3 key pairs. With the ssh option of gpg-agent it can also be used for SSH authentication just like ssh-agent. I use this in combination with a Yubikey configuration setting requiring all GPG sign operations to be confirmed within 10 seconds by pressing the capacitive touch button on my YK4 nano (LED blinks during this time to prompt). This way I can safely enable agent forwarding globally as all SSH session authentication requires physical interaction to confirm (provided you don't have any file-based keys in the same agent which are still vulnerable to usage without your knowledge via this functionality).
    - count 6y ago
      I use the gpg-agent option as well, but hate it (GPG makes me feel icky). That is not, as I understand it, using an X.509 key for authentication though. Which is what I'd like (ssh-agent forward an X.509 based auth mechanism - like remote PKCS#11 over that agent connection, so the key stays on my yubi, and I only need CA certs on the remote hosts.
      - 6y ago
rkeene2 6y ago
If you're going the Smart card route you can get the PIVKey C910 on Amazon for $15/ea. in quantities of 1. You can also buy them for about $0.10/ea on AliExpress, and then load CoolKey or some other applet.
- closeparen 6y ago
  >Platform Support >Windows In-Box PIV Driver (Read Only) and PIVkey Windows Minidriver (Read/Write): Windows Vista, 7, 8, Server 2003, Server 2008, Server 2012. >Mac OSX, Linux and Android (Read Only - Middleware Required) The only open source middleware I know of for OSX is OpenSC, and it doesn't list C910 as a supported card. https://github.com/OpenSC/OpenSC/wiki/Supported-hardware-(smart-cards-and-USB-tokens) https://github.com/OpenSC/OpenSC/wiki/Supported-hardware-(sm...
  - rkeene2 6y ago
    The PIVKey C910 complies with NIST SP-800-73 (PIV) -- same as YubiKey PIV mode, so OpenSC supports it. Also, the middleware I wrote (CACKey) is open source and supports it and works on macOS as a tokend driver.
  - rkeene2 6y ago
    I forgot to mention that also, of course, CoolKey is open source and the CoolKey PKCS#11 module supports the CoolKey applet (obviously) and makes some attempts to support the US DOD CAC and the US Government PIV -- though I don't know how successful they are. Bugs and feature limitations in CoolKey led me to write CACKey.
    - closeparen 6y ago
      Coolkey is trying to link OSX 10.5 libraries and cross-compile for PowerPC. Seems like abandonware. Are you using it successfully in 2020?
      - rkeene2 6y ago
        I mostly use CACKey, since I wrote it to replace CoolKey for my needs.