2

I am looking to implement access controls through CA-signed public ssh keys, as described in the article Scalable and secure access with SSH.

I am trying to conceive how our security team will manage this on the CA side. One thing I would like to be able to do is, after signing a key, I would like to "query" that key to get information about it. In particular, for a given key, I'd like to know:

  • With what CA was it signed (i.e. can I extract some information about the certificate used to sign this key)?
  • What identity has been assigned to this key (-I flag to ssh-keygen)
  • What principal(s) are allowed by this key (-n ssh-keygen flag)
  • What is the validity time for the signature (-V)
  • What is the serial number of this signature (-z)
  • What options have been assigned to this signed key (-O)

Clearly, sshd necessarily needs to decode all those attributes when the key is presented. Is there a programmatic way to extract that info? I am thinking in terms of sanity checks, auditing and reporting on the security team management side.

Edit: I realized I was using incorrect terminology in this post. From the ssh-keygen manpage (emphasis mine):

ssh-keygen supports signing of keys to produce certificates that may be used for user or host authentication. Certificates consist of a public key, some identity information, zero or more principal (user or host) names and a set of options...

As Abraham mentioned below, keys are indeed just keys. Once a key has been signed by a CA, it is no longer just a key, but a certificate.

Lastly, in a stunning display of RTFM Fail, ssh-keygen -L -f certificate does exactly what I need.

Improve this question
1

My cohorts at Gravitational wrote a pure golang tool that parses SSH certificates and run it online here: https://ssh-certificate-parser.gravitational.com/ If you are asking about parsing signed SSH certificates I believe that tool will output all data that's available within the certificate.

Improve this answer
4
  • Thanks, but that appears to be for ssh certificates, I want to parse the actual keys (that have been signed by a cert). Also, our systems (by design), do not have Internet access, so I need an offline solution (or an open source system I can bring in house). – Matt Jun 8 '18 at 14:50
  • SSH keys are simply bare keys and do not contain metadata. Facebook's article calls this out -- "Under the hood, our complex CA infrastructure simply receives a public key, runs all security checks, invokes ssh-keygen to sign it with the CA's private key, and returns the signed certificate back to the client." The source to the aforementioned SSH certificate parsing tool is available in our set of public repos here: github.com/gravitational/keygen – Abraham Ingersoll Jun 9 '18 at 13:02
  • "SSH keys are simply bare keys and do not contain metadata." Perhaps metadata isn't the right word, but a signed ssh key must be more than a bare key. Clearly, it contains information about what principals it is authorized for, the expiration (if any), any options that were used during the signing, etc. How else would the remote host know what is allowed and what is not when it is presented a key? That information must be embedded into the key itself. Since sshd + CA pub key can extract that info, I'd like a reporting tool to do the same. – Matt Jun 14 '18 at 18:51
  • Update: looks like I have a misunderstanding on the terminology. Looks like the process of signing an ssh key with a CA creates a certificate. I was under the impression the generated file was still a key, but with additional embedded information. Sorry for the noise! – Matt Jun 14 '18 at 19:04
0

While you can use ssh-keygen -L -f <cert-file> in case you have an actual certificate file on your disk the following is needed if you have only a temporary SSH certs loaded into ssh-agent and no cert file on disk:

ssh-add -l | ssh-keygen -L

BTW: The confusion with terms "keys" vs. "certificates" is probably because OpenSSH certificates are defined as new OpenSSH key types (ssh-rsa-cert-v01@openssh.com etc.)

See also the specification: PROTOCOL.certkeys

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.