7

I've recently read an article about using an SSH CA. While I'm understanding why signed host keys/certificates are useful, I fail to understand what's the benefit of using signed user keys/certificates over just using unsigned user keys.

Can someone elaborate on this?

Improve this question
1
  • 1
    Why is the usefulness of signed host certs not applicable to users? – schroeder♦ Jun 13 '17 at 11:44
15

It's useful so you can grant access to any key signed by that particular CA certificate. For example, you have a server which trusts a CA. You can now allow access to any user by signing their key using the CA without having to add their key to the server itself, which might be impossible (let's say it's an embedded device with read-only storage so any addition to .ssh/authorized_keys will be lost on next reboot).

Improve this answer
6
  • Furthermore, you can trust other information on the cert as well. For example, your server can use a field in the DN (such as CN or OU) to identify a particular user or group. – John Deters Jun 13 '17 at 13:12
  • Thanks. I totally missed the point that the user cert is not copied to the target machine (but only to the user's machine). – Sebastian Krysmanski Jun 13 '17 at 14:39
  • …or giving a user access to a huge number of machines accepting the CA, without having to manually go through each and add the key – Bergi Jun 13 '17 at 16:21
  • @JohnDeters isn't it possible to generate a cert with any values in there? – Display Name Jun 13 '17 at 16:58
  • 1
    @JohnDeters: the certificates used by OpenSSH are its own unique format, not the X.509 format that LetsEncrypt or any other 'internet' CA is capable of issuing. – dave_thompson_085 Jun 14 '17 at 1:22
3

Using signed ssh-keys for users has several benefits:

  • The user's public key is not distributed to the servers as ~/.ssh/authorized_keys, that saves a lot of pain.
  • ~/.ssh/authorized_keys can not be mis-used by adding other identities to it.
  • Access control using public keys can be immutable.
  • The signed key can have a time limit (lease)
  • The signed key can be assigned a principal (admin account) no need to create extra users, just log sshd VERBOSE for fingerprint
  • The signature of the key can enforce restrictions of the options that man (5) authorized_keys lists.
  • Signed keys have a revoke method.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.