1

I'm setting up an SSH key signing server, using Neflix BLESS as the base github(dot)com/Netflix/bless.

There is a critical option for source-address to ensure that the certificate can only be used from a list of specific IP addresses, but I cannot find an option for a destination-address to restrict access to a single server.

We are not using a bastion host and want to ensure that the signed key that is returned, isn't simply used against another server that recognizes the CA, but to which the user isn't authorized.

I've checked https://www.freebsd.org/cgi/man.cgi?query=ssh-keygen&sektion=1&manpath=OpenBSD and https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.certkeys?annotate=HEAD and can't seem to find an option that would handle this.

The only thing that I've see that might lend some insight is

...if an implementation does not recognise a optionthen the validating party should refuse to accept the certificate.

Which makes me think that there may be some list of what some implementation supports, but I can't seem to find anything.

Improve this question
1
  • Some implementations may check against common name (CN) in certificate signing request, e.g. -subj '/C=mycountry/ST=mystate/L=myarea/O=myorg/CN=IP'
    – postoronnim
    Commented Jun 15, 2020 at 20:13

2 Answers 2

Reset to default
1

but I cannot find an option for a destination-address to restrict access to a single server.

This is interesting question. I didn't try that, but it looks like the same option could be used for the destination-address in the user certificates.

If it does not work, it is most probably because nobody thought about this use case so if you would like to see that implemented, you should get in touch with upstream developers, for example on their mailing list.

Which makes me think that there may be some list of what some implementation supports, but I can't seem to find anything.

No, there is none. As far as I know, no other implementation supports the OpenSSH certificates yet.

Improve this answer
0

I was able to find a simple solution to meet the need. While there isn't a destination-address option, the key is embedding that information the principal of the certificate.

Instead of using root or user, etc. for user names, we used privileged_10.x.x.x and unprivileged_10.x.x.x as the 2 users on the box, with the ip address in the name.

This obviously isn't a direct solution, especially if the user names absolutely can't be modified. But it does restrict access to specific machines.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .