We need better support for SSH host certificates

Re:We need better support for SSH host certificates by misnome on Monday March 27, 2023 @06:36AM (#35324972)

One thing I've never understood about SSH certificates for client identification - it looks like it causes the requirement that _at some point_ ssh private keys and the certificate private key need to both be in the same place? And if this is the case, then doesn't that imply that you need to have a service where users upload their private key?

Which would mean you have one single point of attack/DOS/failure that needs to be kept utterly secure at all costs?

[ Parent | on HN ]

Re:We need better support for SSH host certificates by karatinversion on Monday March 27, 2023 @06:42AM (#35325006)

I thought the way it worked was that the certificate signed with the certificate private key only contains the public key, and the ssh server, after checking the certificate is valid, validates that the client has the private key corresponding to the public key in the certificate.

[ Parent | on HN ]

Re:We need better support for SSH host certificates by sokoloff on Monday March 27, 2023 @06:55AM (#35325085)

You give your public key (into authorized_keys) and then prove you have access to the matching private key as the essential part of the challenge. You always keep the private key.

[ Parent | on HN ]

Re:We need better support for SSH host certificates by calvinmorrison on Monday March 27, 2023 @10:11AM (#35326883)

Also - key forwarding. Private key is on your local, you can forward it through ssh so you can hop around from your next destination

[ Parent | on HN ]