Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

Re:Show HN: SSH Permit A38 – Central Managment and Deploymen... by tr0ut on Sunday March 18, 2018 @07:38PM (#16615185)

There is a security issue with using AD/OpenLDAP. That being passwords. An example is you can debug/trace the SSH process and see(log) passwords in clear text.

Now of course this is both a trust and a escalated privilege issue. But a lot harder(impossible) with keys.

[ Parent | on HN ]

Re:Show HN: SSH Permit A38 – Central Managment and Deploymen... by vertex-four on Monday March 19, 2018 @06:07AM (#16617257)

There's various methods to put SSH keys in LDAP. LDAP is an extensible database, so you can add a schema to attach SSH keys to a user (various schemas exist) - and the AuthorizedKeysCommand in your sshd_config can be hooked up to any program which can retrieve keys for a given user from anywhere (again, various programs exist).

As an example already put together: https://github.com/jirutka/ssh-ldap-pubkey

[ Parent | on HN ]

Re:Show HN: SSH Permit A38 – Central Managment and Deploymen... by subway on Sunday March 18, 2018 @10:45PM (#16615907)

If you're using straight passwords, sure, an ssh key (ideally in a directory) is going to beat a password-only login, but that ssh key is still subject to credential theft. I'm in the process of migrating an environment off of ssh-key authentication over to password+otp based kerberos (FreeIPA, though AD makes this easy too). A single password+otp login gets an 8 hour (non-renwable, in this environment) ticket. At the end of those 8 hours, users have to obtain another ticket with a password+otp. What's particularly nifty about this scheme is that it's useful for not only ssh access, but internal https services as well.

[ Parent | on HN ]

Re:Show HN: SSH Permit A38 – Central Managment and Deploymen... by detaro on Sunday March 18, 2018 @07:44PM (#16615213)

You can put keys in LDAP.

[ Parent | on HN ]