3 ms·

Whilst this is clearly an interesting development, I still prefer SSH CA backed by hardware on both issuer and client side (e.g. Yubikey). This is for three re

Whilst this is clearly an interesting development, I still prefer SSH CA backed by hardware on both issuer and client side (e.g. Yubikey). This is for three reasons: First, the SSH-CA+Hardware method does not require call-out to third-party code from SSHD, and thus minimises attack surface and attack vectors. Second, the SSH-CA+Hardware method completely prevents key exfiltration or re-use attacks. Yes, I understand that the SSH keys issued by OPKSSH (or similar tools) are short-lived. But they are still sitting there in your the .ssh directory on your local host, and hence open to exfiltration or re-use. Yes it may be a short-timeframe but much damage can easily be done in a short timeframe, for example exfiltrate key, login, install a backdoor and continue your work via the backdoor. Finaly, the SSH-CA+Hardware method has fewer moving parts. You don't even need software tools like step-ca. You can do everthing you need with the basic ssh-keygen command. Which means from a sysadmin perspective, perhaps especially sysadmin "emergency break-glass" perspective, you do not need to rely on any third-party services as gatekeeper to your systems.

e40 2y ago
Can you recommend a setup guide?
- traceroute66 2y ago
  > Can you recommend a setup guide? Depends how far up the chain you want to go (e.g. use step-ca or not), but at the most primitive level, you are looking at something along the following lines of the below (the below is based off my rough notes, I might have missed something). Note that I have ignored any Yubikey setup considerations here like setting PIN, touch-requirement etc. etc. I have also assumed plain Yubikey, not the YubiHSM. The YubiHSM comes with SSH certificate signing functionality "out of the box". Client Yubikey: - Use Yubikey ykman[1] to generate a PIV key according to your tastes - Grab the key in ssh format with `ssh-keygen -D $path_to/libykcs11 -e > $client_key.pub` Issuer Yubikey: - Use Yubikey ykman[1] to generate a PIV key according to your tastes - Grab the key in ssh format with `ssh-keygen -D $path_to/libykcs11 -e > $issuer_key.pub` (save this for the next step and also put it into your sshd CA config) - Sign with the issuer Yubikey with `ssh-keygen -s $issuer_key.pub -D $path_to/libykcs11 -I $whatever_identity -n $principal_list -V +$validity_period $client_key.pub` (libykcs11 is the yubikey library,it ships with yubikey-piv-tool[2]) [1] https://docs.yubico.com/software/yubikey/tools/ykman/PIV_Commands.html https://docs.yubico.com/software/yubikey/tools/ykman/PIV_Com... [2] https://developers.yubico.com/yubico-piv-tool/Releases/ https://developers.yubico.com/yubico-piv-tool/Releases/ ==== Edit to add links to various more verbose discussions on the subject (in no particular order): - https://liw.fi/sshca/ - https://goteleport.com/blog/how-to-configure-ssh-certificate-based-authentication/ - https://jamesog.net/2023/03/03/yubikey-as-an-ssh-certificate-authority/ - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/sec-ssh_certificate_pkcs_11_token Also some verbose discussions on the possibility of doing so with FIDO2. Altough note that the native version of ssh on Apple OS X does not support FIDO2, therefore if you want native Apple support you are best sticking with the PIV method instead. - https://developers.yubico.com/SSH/Securing_git_with_SSH_and_FIDO2.html - https://medium.com/@harrishcluo/yubikey-ssh-git-super-secure-your-development-workflow-2-2-1899379fb882 - https://blog.millerti.me/2021/05/16/strengthen-github-ssh-access-with-fido2s-pin-support/

e40 2y ago

Can you recommend a setup guide?

traceroute66 2y ago
> Can you recommend a setup guide? Depends how far up the chain you want to go (e.g. use step-ca or not), but at the most primitive level, you are looking at something along the following lines of the below (the below is based off my rough notes, I might have missed something). Note that I have ignored any Yubikey setup considerations here like setting PIN, touch-requirement etc. etc. I have also assumed plain Yubikey, not the YubiHSM. The YubiHSM comes with SSH certificate signing functionality "out of the box". Client Yubikey: - Use Yubikey ykman[1] to generate a PIV key according to your tastes - Grab the key in ssh format with `ssh-keygen -D $path_to/libykcs11 -e > $client_key.pub` Issuer Yubikey: - Use Yubikey ykman[1] to generate a PIV key according to your tastes - Grab the key in ssh format with `ssh-keygen -D $path_to/libykcs11 -e > $issuer_key.pub` (save this for the next step and also put it into your sshd CA config) - Sign with the issuer Yubikey with `ssh-keygen -s $issuer_key.pub -D $path_to/libykcs11 -I $whatever_identity -n $principal_list -V +$validity_period $client_key.pub` (libykcs11 is the yubikey library,it ships with yubikey-piv-tool[2]) [1] https://docs.yubico.com/software/yubikey/tools/ykman/PIV_Commands.html https://docs.yubico.com/software/yubikey/tools/ykman/PIV_Com... [2] https://developers.yubico.com/yubico-piv-tool/Releases/ https://developers.yubico.com/yubico-piv-tool/Releases/ ==== Edit to add links to various more verbose discussions on the subject (in no particular order): - https://liw.fi/sshca/ - https://goteleport.com/blog/how-to-configure-ssh-certificate-based-authentication/ - https://jamesog.net/2023/03/03/yubikey-as-an-ssh-certificate-authority/ - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/sec-ssh_certificate_pkcs_11_token Also some verbose discussions on the possibility of doing so with FIDO2. Altough note that the native version of ssh on Apple OS X does not support FIDO2, therefore if you want native Apple support you are best sticking with the PIV method instead. - https://developers.yubico.com/SSH/Securing_git_with_SSH_and_FIDO2.html - https://medium.com/@harrishcluo/yubikey-ssh-git-super-secure-your-development-workflow-2-2-1899379fb882 - https://blog.millerti.me/2021/05/16/strengthen-github-ssh-access-with-fido2s-pin-support/