OpenSSH - SSH Certificates
Vložit
- čas přidán 22. 06. 2024
- Today I will be looking at using openssh key pairs to replace the openssh password, however with a bit of a difference. Instead of using just host and user keys, I will be configuring OpenSSH Server and OpenSSH client to use host and user certificates.
Note: This is a step up from using SSH public and private keys for your host and users
00:00 - Intro
00:28 - Host & User Certificates for OpenSSH
00:48 - OpenSSH key management
01:44 - Public Key and Passwords
02:49 - Trust on First Use (TOFU)
05:13 - Best Practice - Use SSH Certificates
07:20 - Create Host CA keys
08:20 - Host Certificate
11:26 - Best Practice - Use Separate Host and User CAs
12:40 - Create User CA
13:06 - Generate or re-use existing Host Keys
13:40 - Sign the Host Certificates
14:48 - Copy Host Keys and Host Cert to SSH Server
15:53 - Configure SSH Clients to use Host Certificates
17:11 - User Keys
17:30 - Sign User Public Key
18:28 - Copy User Keys and User Cert to User Home Dir
18:47 - Configure TrustedUserCAKeys
19:34 - Other Best Practices
20:19 - What we covered
21:01 - Outro
Support me on Patreon: / djware
Follow me:
Twitter @djware55
Facebook: / don.ware.7758
Discord: / discord
Gitlab: gitlab.com/djware27
"Brightly Fancy" Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
creativecommons.org/licenses/b...
"Militaire Electronic" Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
creativecommons.org/licenses/b...
Werq by Kevin MacLeod
Link: incompetech.filmmusic.io/song...
License: filmmusic.io/standard-license
Industrial Cinematic by Kevin MacLeod
Link: incompetech.filmmusic.io/song...
License: filmmusic.io/standard-license
Music Used in this video
"NonStop" Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 3.0 License
#ssh #openssh #opensshcert - Věda a technologie
Feeling stupid is the price we pay for learning new stuff. Thanks for another informative video!
I have now watched and paid attention to all of the current video uploads on SSH--Great. Thank You.
Demo is always good. It is slower but one can think/digest the information while you type commands in. :-)
Good point, I'll keep this in mind next I give a presentation 👌
This is a great series. Didn't know ssh supported certificates like this.
There are a lot of quality of life features hidden away in the docs and config files if you just look for them.
My dude DJ Ware, just like everyone else here - shout out to all you mah peers I haven't met yet :nerd: -, be it a distro review, a file system review, or anything related to the good ol' OpenSSH, keep the good stuff coming!! 👊
You sound like Jeff Bridges and it's oddly soothing. Thanks for the great video!
Wow, thanks!
I refer to something called PKI in this video, Public Key Infrastructure (PKI) is a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. There is no such thing as "lightweight" PKI as this video talks about, I use it to describe something which falls short of full PKI compliance.
Thanks for another highly informative video.
Keyboard fumbling is educational so fumble away.
Jokes aside, seeing the action performed as it is discussed is a more stimulating experience. With audio and static text I tend to just read ahead and then it's easy to miss points being made in the discussion.
Love this very helpful series on SSH!
I for one would very much like to see a demo!
Would help me understand the process a bit better.
Will do some keyboard stumbling for tomorrows video
As always watching your video, I learned something new today. Thank you.
Finally someone talks about it
Great info! as always.
Well done DJ!
video on teleport would be cool 😎
Thanks DJ👍!
DJ Ware is the man !
Demos are always good and teleport would be cool to do a video about it.
I am working with it next week, maybe will become proficient enough to do a video about it soon, thank you Andrei
Doing it for a while now. It's amazing since you can create and revoke certificates as you wish. And with time limits. It's a great way to give access to "strangers" to one of your maschines i love it. Btw. it's the same stuff they use for the covid apps in Europe.
Hi DJ Ware, you talk about a lot of best practices for SSH, I'm surprised you didn't mention setting up a central certificate directory since you mention so much about key management. I've seen many places that implemented SSH to use /etc/ssh/Authorized_Keys/%u, with the filename/cert in that directory being the username.
There are some permissions that need to be set correctly but isn't that a better practice than letting users store it in ~/.ssh.
I would think managing a single sync in a single location instead of updates at every logon would seem like less overall management overhead of the keys. What are your thoughts on that? Are there any good reasons to not do this?
Is possible to put user private cert key into /etc/ssh for security, you know, in case the user’s password were guessed, or something?
Hi @egbertst7314, technically you can put ssh keys anywhere you want too, you would just need to identify where it was in the .ssh/config file using the IdentfyFile to show the location, just be careful when storing them in a "centralized" place 1) it doesnt get compromised 2) you dont accidently overlay someone else's key with the new one you are adding, also be aware some pam authorizations will fail if the keys are moved. For me managing them in their home directory locations is usually the better idea
Top notch again thanks for this. I was guilty as well for a bad ssh hygiene and use TOFU (your slide showed that the minority uses it? I guess it is rather the majority), but this is the very next I'll do.
But, how do you deal with cloud servers. You will have no access physical so you basically beef to trust it for the very first setup. I haven seen any cloud Provider for having a solution to verify the connection hasn't been tampered with.
Hi Marcella, will cover that when I get to Teleport it’s designed for cloud
@@CyberGizmo thanks mister DJ but please never call me a girl :D
@@marcello4258 opps sorry just a typo
Hi i cant login using user user ca