Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Interestingly enough this is getting another layer on top of it. Google is working on something called "HIBA" (https://github.com/google/hiba) which is an extension to OpenSSH SSH Certificates.

So now you have layers of:

- SSH RFC

- OpenSSH extensions to SSH

- Google extensions to OpenSSH



More layers, more abstractions, more divergence, more interoperability problems, more vulnerabilities.

There's already mature CA support in OpenSSH

https://dev.to/gvelrajan/how-to-configure-and-setup-ssh-cert...

And even OpenSSH 8.2+ supports FIDO2 built-in.

Can add TOTP, FIDO2/u2f, ldap, or kerb with pam also.


What’s the value of a CA in openSSH? Is it purely so you don’t have to self manage known_hosts, based on mutual trust with the CA?

Edit: or is there some ability for clients to leverage the CA to establish trusts without authorized_keys?


Both. Either. See more: https://web.archive.org/web/20201203110622/https://ef.gy/har...


This looks like it's adding something similar to Kerberos-like authentication the connection rather than the OS auth level. Pretty cool.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: