On Tue, 23 Jun 2020, Alejandro Dabin wrote:
> Hi,
> We're developing an open source project that uses SSH certificates. We
> issue short lived certificates (few minutes) to execute commands on behalf
> of users. We have a use case where we need to issue certificates with 10
> days validity and store them, so we put a command inside them:
>
> ssh-keygen -s ca-key -I certN -n user -O force-command="wget something" -V
> +10d user-key.pub
>
> and it works as expected. This way, if the certificate is stolen, it can
> only be used to execute that command (also the CA is only trusted from some
> hosts, no root login, etc).
>
> We also want to use "ForceCommand" option on the server (inside a "Match"
> section) to put a wrapper that checks commands executed for this CA. If a
> rogue certificate is issued, at least we can control what is executed.
> However, as the command is embedded inside the certificate, the server
> passes an empty "SSH_ORIGINAL_COMMAND" to the wrapper. I couldn't find any
> additional option or environment variable for this case. We can pass the
> command when the connection is established, but it defeats the purpose of
> having the certificate's "force-command".
>
> So, is there a way the wrapper could get the command embedded inside a
> certificate?
I think your best avenue would be to set ExposeAuthInfo=yes in
sshd_config (note: requires a relatively recent sshd) and parse it out
of the certificate listed in $SSH_USER_AUTH. E.g.
grep "^publickey .*cert[a-z0-9-]*@openssh.com" $SSH_USER_AUTH \
| awk '{print $2 " " $3}' | ssh-keygen -Lf -
> As a side note, more information about the certificate (issue and
> expiration time) could be useful for auditing. It would be useful too if
> the server could log it (aside from CA, certificate serial, etc), but
> couldn't find any option either.
No, the logging tries to balance between usefulness and brevity.
I'm not sure why expiry information would be useful there - I would
have thought that it's either it's good and accepted or bad and not...
-d
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
