EthanHeilman

8 ms·

91.
by EthanHeilman 2y ago
Care to provide any evidence for your claim? At the very least put in the work to redefine the word empire to have such a broad and expansive definition that the US would qualify
92.
by EthanHeilman 2y ago
I believe this poster is viewing this statement by another Hn poster as official confirmation that US foreign policy has been driven a single mission of subjugating other countries. I disagree with this view. The US is powerful on the inter
93.
by EthanHeilman 2y ago
That's really cool. Are you using OpenSSHes yubikey support or building your own?
94.
by EthanHeilman 2y ago
opkssh ( https://github.com/openpubkey/opkssh ) it lets you configure OpenSSH so you can ssh using your OpenID Connect identity without adding a trusted party other than the IDP. I'm trying to figure out how to TOFU
95.
by EthanHeilman 2y ago
Tested sftp works and created an integration test for sftp
96.
by EthanHeilman 2y ago
> Is anybody aware of something like this that can be automated for things like ansible Doesn't ansible already get you all of this? What is the feature gap you are looking to fill? That said you definitely use opkssh in automation.
97.
by EthanHeilman 2y ago
Completely agree. The goal is simple, plain and obvious, but the tools and protocols make it tricky to pull off.
98.
by EthanHeilman 2y ago
There is an issue with a lively discussion happening currently "Key management improvements on the client and SSH agent support": https://github.com/openpubkey/opkssh/issues/6#issuecomment-2...
99.
by EthanHeilman 2y ago
Do you recommend it? How easy is it to edit videos and add overlays and images? I've been looking for something to record demos of opkssh. What I have now isn't cutting it.
100.
by EthanHeilman 2y ago
Currently IDPs don't care about user public keys. OpenPubkey manages to slip the user's public key into an issued ID Token without the IDP having to know about it. Ideally IDPs are CAs for identity and ID Tokens have a public key
101.
by EthanHeilman 2y ago
That's awesome. The web needs more terminal interfaces. What did you use to build that slick explainer video?
102.
A Brief Examination of Hacking Team's Crypter (2015)(ethanheilman.com)
2 points by EthanHeilman 2y ago|0 comments
103.
by EthanHeilman 2y ago
That documentation refers to a much older and closed source version of opkssh. > It seems like to use OpenPubKey you also need a fairly modern version of OpenSSH. On versions of OpenSSH older than 8.1 (2019), you may run into issues if y
104.
by EthanHeilman 2y ago
Super authorities are a neat idea. It would be nice to have something like 2of2 permissions where two parties have to both ok a change for policy to accept it.
105.
by EthanHeilman 2y ago
All the major OpenID Provider want you to use a browser so that users aren't exposing their raw credentials like passwords to an application. We did have an experimental version of this working in a terminal for integration tests a lon
106.
by EthanHeilman 2y ago
If you really believe that then help me get the cosigner working with opkssh so even if Google is fully malicious they can't get ssh access.
107.
by EthanHeilman 2y ago
> Why not just leverage sshca auth? Because that has two trusted parties: the IDP and the SSH CA. OPKSSH has just one trusted party: the IDP. > This ensures that the user is both in possession of the physical device and that the crede
108.
by EthanHeilman 2y ago
That's smart! You could probably automate that using a cron job pulling the latest CA public keys so servers automatically rotates CA public keys every few days. > If missing servers is a common problem it sounds like there are some
109.
by EthanHeilman 2y ago
Is audit logs and access control the main features that would convince you to use Teleport vs something like opkssh? How important is the VPN functionality that lets you get packets to private IPs?
110.
by EthanHeilman 2y ago
I work on opkssh and I agree with everything you have just said. The value of opkssh makes sense in an environment in which already have OpenID Connect as the foundation for identity in your system. OpenPubkey[0], the protocol opkssh is bui
111.
by EthanHeilman 2y ago
> As for pre-seeded/offline JWKS, yeah the biggest concern is around availability. The pre-seeded case would handle fresh VM setups before networking might be fully configured (though other auth methods as fallback would be good eno
112.
by EthanHeilman 2y ago
You can do this with OpenPubkey, since the user's client can sign challenges that include the scope of the authentication. Doing this on the web requires being really careful design because you can't trust a javascript client sent
113.
by EthanHeilman 2y ago
It is not a patch. It doesn't require any code changes to OpenSSH. opkssh uses AuthorizedKeysCommand field in sshd_config. OpenBSD added this config field to OpenSSH to enable people to do stuff like opkssh or instance-connect without
114.
by EthanHeilman 2y ago
That's neat, I've added it to my reading list.
115.
by EthanHeilman 2y ago
OpenPubkey does support X.509 using an X.509 extension.
116.
by EthanHeilman 2y ago
No, the SSH server only learns your public key and a signature specific to the SSH server generated in the SSH handshake. A malicious server would need your private key to successfully authenticate to another SSH server.
117.
by EthanHeilman 2y ago
I got this working at one point. The trick is to use your SSH config to intercept SSH connections so the got to a local SSH server, this triggers ProxyCommand and let's you create the cert and then forward those packets into an outgoi
118.
by EthanHeilman 2y ago
When I looked at this previous Tailscale required two trusted parties. I haven't looked at the tailscale protocol details in two years so maybe it has changed.
119.
by EthanHeilman 2y ago
Thanks for that link, I hadn't heard about this. It looks really cool and I am glad to see ubuntu doing this. I should send ubuntu an email. Sadly I can not offer an opinion as I don't know how authd works. I intend to find.
120.
by EthanHeilman 2y ago
> This does seem to impose the limitation of exactly one client ID per IdP, which could complicate rotating client IDs. Thanks for asking this. I don't see any reason why you use the same IdP with two different Client-IDs. I haven&#

More ›