6 ms·

In that vein, is there something that could allow me to manage authorized_keys via DNS? Let's say I own capableweb.com, I'd love it if sshd could just read all

• knewter 4y ago
  A tiny bash script and a cronjob
• dgl 4y ago
  As mentioned elsewhere in this thread, actually using SSHFP in a secure way is difficult. Far better is to use SSH host certificates, then your known_hosts can simply have a @cert-authority * some-cert in it. (See https://www.lorier.net/docs/ssh-ca.html https://www.lorier.net/docs/ssh-ca.html)
• toast0 4y ago
  You might consider checking in an authorized_keys file? Not as fun as dns, but maybe easier. You can use ssh-keyscan to build the file.
• benmanns 4y ago
  If you trust GitHub you could curl https://github.com/capableweb.keys https://github.com/capableweb.keys on startup
• Queue29 4y ago
  Similar idea: This runs as a cron/systemd timer and updates your authorized_keys from your GitHub account. https://github.com/shoenig/ssh-key-sync https://github.com/shoenig/ssh-key-sync
  • samber 4y ago
    https://github.com/samber/sync-ssh-keys/ https://github.com/samber/sync-ssh-keys/
• hamandcheese 4y ago
  AuthorizedKeysCommand is what you are looking for. https://man.openbsd.org/sshd_config#AuthorizedKeysCommand https://man.openbsd.org/sshd_config#AuthorizedKeysCommand
  • capableweb 4y ago
    That is indeed what seems to be the most useful out of all the replies, thanks a lot!
    • t0mas88 4y ago
      Be warned that when using this a lot of the security comes down to your own implementation of that command. The suggested alternative using certificates is a much more standard way that has less ways to create holes in your security.
      • capableweb 4y ago
        Maybe I'm missing something obvious, but seems to be much more up to the security of my DNS setup rather than the command. The command would basically hit "keys.my-domain.example" and return the values of each TXT record. Not sure what could go wrong here, besides if I lose DNS access, I won't have access to the boxes. Probably add some sort of caching as well for that. But otherwise, it seems to be much more about the security of what goes into "keys.my-domain.example".
        • t0mas88 4y ago
          That's what I meant. Just looking up a DNS record as an implementation sounds like a bad idea. You would have to set up thinks like DNSSec validation, and consider all the ways in which that could fail.
• Drewza 4y ago
  There are also 'free for personal' use commercial systems that work in a similar way to some of the suggestions posted in the comments: https://www.keystash.io https://www.keystash.io
• Galanwe 4y ago
  The cleanest way in your use case would be to store keys in an LDAP server instead of local users' authorized_keys You can plug any of your server to this LDAP and enjoy the same users and keys everywhere.
• ttyprintk 4y ago
  An SSH certificate authority is what I’d choose for that. Can work with both user keys and host keys. The host certs have a field for demonstrating their hostname; the user certs have a field restricting their username. So, as the certificate authority you have a little more power than what you can distribute via DNS.
• sammax 4y ago
  I’ve set up an AuthorizedKeysCommand that uses unbound to get the authorized keys for the server via DNSSEC, with the ability to specify keys for whole servers, users on servers or globally for all servers. This is pretty neat for my few private boxes, I wouldn’t advise it for something bigger or enterprise, an ldap or similar seems better for that.
  • tptacek 4y ago
    People scaling SSH authorization tend to set up SSH CAs (either directly, or baked into some higher-level management solution). SSH CAs scale down nicely, as well.