6 ms·

[Note on edit: this is wrong] ... apparently in the form of a whole new implementation. Not realistic. If it's not in OpenSSH, it effectively doesn't exist.

asjfkdlf 2y ago
It states that it doesn’t require major changes because it all happens under the SSH protocol. A new program is needed on the client to sign in and you can already run a custom program on the server to authorize the key.
- Hizonner 2y ago
  I stand corrected. Still not sure I'd want to expose my SSH infrastructure to the massive kludge tower that is OpenID, but it not being its own implementation of the actual SSH protocol is a huge plus.
  - dugite-code 2y ago
    I imagine it wouldn't be for the system admins to use, it's for all the other users who can use terminal applications but always treat ssh keys as a nuisance and try to avoid them as much as possible.
- rcarmo 2y ago
  Lost me at "A new program is needed on the client". Completely.
dugite-code 2y ago
From the article "OPKSSH does not require any code changes to the SSH server or client." Looks like this is a sidecar application. So potentially very useful, also potentially very brittle.
EthanHeilman 2y ago
Author of the blog here and main opkssh contributor. The title is wrong but this is OpenSSH and not a whole new implementation. opkssh uses the OpenSSH AuthorizedKeysCommand configuration option like AWS instance-connect to add OpenID Connect validation to OpenSSH authentication. ``` opkssh login ``` Generates a valid ssh key in `~/.ssh/` Then run bog standard ssh or sftp ``` ssh user@hostname ``` ssh will pull this ssh key from `~/.ssh/` and send it to sshd running on your server. If this key isn't in an AuthorizedKeys file sshd will send it to the AuthorizedKeysCommand which if configured to be `opkssh` will check your OpenID Connect credentials.
- zaat 2y ago
  Just to make sure, opkssh supports OpenID for sftp as well?
  - EthanHeilman 2y ago
    It should, opkssh just creates ssh public keys. The integration tests don't current cover that case so I created an issue to add that to the integration tests: https://github.com/openpubkey/opkssh/issues/40 https://github.com/openpubkey/opkssh/issues/40
  - EthanHeilman 2y ago
    Tested sftp works and created an integration test for sftp
- mdaniel 2y ago
  I'm surprised it defaults to writing out key material into the filesystem[1] when SSH Agent has existed for quite a while. This use case seems especially relevant to sticking them in the agent given that (IIUC) these are short-lived certs anyway, so if your agent bounced you'd just get a fresh one without drama I do see <https://github.com/openpubkey/opkssh/issues/6#issuecomment-2727546609 https://github.com/openpubkey/opkssh/issues/6#issuecomment-2...> so I'm glad it's conceptually on the radar, I'm just saying I'm surprised it wasn't part of Cloudflare's best practices already 1: https://github.com/openpubkey/opkssh/blob/v0.3.0/commands/login.go#L201 https://github.com/openpubkey/opkssh/blob/v0.3.0/commands/lo...

asjfkdlf 2y ago

It states that it doesn’t require major changes because it all happens under the SSH protocol. A new program is needed on the client to sign in and you can already run a custom program on the server to authorize the key.

Hizonner 2y ago
I stand corrected. Still not sure I'd want to expose my SSH infrastructure to the massive kludge tower that is OpenID, but it not being its own implementation of the actual SSH protocol is a huge plus.
- dugite-code 2y ago
  I imagine it wouldn't be for the system admins to use, it's for all the other users who can use terminal applications but always treat ssh keys as a nuisance and try to avoid them as much as possible.
rcarmo 2y ago
Lost me at "A new program is needed on the client". Completely.

dugite-code 2y ago

From the article "OPKSSH does not require any code changes to the SSH server or client." Looks like this is a sidecar application. So potentially very useful, also potentially very brittle.

EthanHeilman 2y ago

Author of the blog here and main opkssh contributor. The title is wrong but this is OpenSSH and not a whole new implementation. opkssh uses the OpenSSH AuthorizedKeysCommand configuration option like AWS instance-connect to add OpenID Connect validation to OpenSSH authentication. ``` opkssh login ``` Generates a valid ssh key in `~/.ssh/` Then run bog standard ssh or sftp ``` ssh user@hostname ``` ssh will pull this ssh key from `~/.ssh/` and send it to sshd running on your server. If this key isn't in an AuthorizedKeys file sshd will send it to the AuthorizedKeysCommand which if configured to be `opkssh` will check your OpenID Connect credentials.

zaat 2y ago
Just to make sure, opkssh supports OpenID for sftp as well?
- EthanHeilman 2y ago
  It should, opkssh just creates ssh public keys. The integration tests don't current cover that case so I created an issue to add that to the integration tests: https://github.com/openpubkey/opkssh/issues/40 https://github.com/openpubkey/opkssh/issues/40
- EthanHeilman 2y ago
  Tested sftp works and created an integration test for sftp
mdaniel 2y ago
I'm surprised it defaults to writing out key material into the filesystem[1] when SSH Agent has existed for quite a while. This use case seems especially relevant to sticking them in the agent given that (IIUC) these are short-lived certs anyway, so if your agent bounced you'd just get a fresh one without drama I do see <https://github.com/openpubkey/opkssh/issues/6#issuecomment-2727546609 https://github.com/openpubkey/opkssh/issues/6#issuecomment-2...> so I'm glad it's conceptually on the radar, I'm just saying I'm surprised it wasn't part of Cloudflare's best practices already 1: https://github.com/openpubkey/opkssh/blob/v0.3.0/commands/login.go#L201 https://github.com/openpubkey/opkssh/blob/v0.3.0/commands/lo...