4 ms·
Interestingly enough this is getting another layer on top of it. Google is working on something called "HIBA" (https://github.com/google/hiba https://github.com
by er4hn 4y ago
Interestingly enough this is getting another layer on top of it. Google is working on something called "HIBA" (https://github.com/google/hiba https://github.com/google/hiba) which is an extension to OpenSSH SSH Certificates.
So now you have layers of:
- SSH RFC
- OpenSSH extensions to SSH
- Google extensions to OpenSSH
- awesomeMilou 4y agoThis looks like it's adding something similar to Kerberos-like authentication the connection rather than the OS auth level. Pretty cool.
- 1letterunixname 4y agoMore layers, more abstractions, more divergence, more interoperability problems, more vulnerabilities. There's already mature CA support in OpenSSH https://dev.to/gvelrajan/how-to-configure-and-setup-ssh-certificates-for-ssh-authentication-b52 https://dev.to/gvelrajan/how-to-configure-and-setup-ssh-cert... And even OpenSSH 8.2+ supports FIDO2 built-in. Can add TOTP, FIDO2/u2f, ldap, or kerb with pam also.
- hsbauauvhabzb 4y agoWhat’s the value of a CA in openSSH? Is it purely so you don’t have to self manage known_hosts, based on mutual trust with the CA? Edit: or is there some ability for clients to leverage the CA to establish trusts without authorized_keys?
- pritambaral 4y agoBoth. Either. See more: https://web.archive.org/web/20201203110622/https://ef.gy/hardening-ssh https://web.archive.org/web/20201203110622/https://ef.gy/har...