6 ms·

Yeah and whatever you do, don't be deploying SSHFP DNS record unless its DNS server is running DNSSEC AND ... AND your web browser/client is also using DNSSEC-v

• tptacek 1y ago
  SSHFP is baffling to me. The entire point of the DNS is to make introductions between parties with no preexisting relationship, which is exactly not how an SSH cluster works. SSH already has a (very good) certificate system that solves the same problem. Why would you include the global DNS among your trust anchors!?
  • egberts1 1y ago
    It was for me too. But when ordered by my boss to implement SSHFP, the hacker in me took it apart and made this checklist. In hindsight, it isn't a very useable DNS RCODE. And yes, it is preferable to use SSH certificates (for as long as you are aware that private keys must be guarded jealously). We need PAKE capability in SSH, preferably Signal-like protocol for authentication.
    • egberts1 1y ago
      Oh yeah, you are better off having a separate but hardened SSH authentication server that is to be consulted by such SSH gateways, just to protect the private keys. And use DTLS (two sets of client and server PKI , one for each direction) to guard that link between SSH gatewat(s) and SSH authentication (certificate-based) server. The starting point of all this: https://jpmens.net/2019/03/02/sshd-and-authorizedkeyscommand/ https://jpmens.net/2019/03/02/sshd-and-authorizedkeyscommand...