Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for FIDO2 pubkey auth for SSH server #12001

Open
adiroiban opened this issue Sep 24, 2023 · 6 comments · May be fixed by #12002
Open

Add support for FIDO2 pubkey auth for SSH server #12001

adiroiban opened this issue Sep 24, 2023 · 6 comments · May be fixed by #12002

Comments

@adiroiban
Copy link
Member

This is to implement the userauth server-side of https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.u2f

The security key (sk-) implementation is for now only OpenSSH specific.

The GitHub.com server (SSH-2.0-babeld-70f1bac9 but maybe OpenSSH in the backend) also supports it.

For the scope of this ticket, my plan is to have support only for:

This means:

  • Load public blob
  • validate signature

Certificates are out of scope.
WebAuthN is out of scope.

In the past, getting yubikey to work with SSH was a pain via PGP or SmartCard

With this, OpenSSH has direct access to the fido2 keys.
@adiroiban adiroiban linked a pull request Sep 24, 2023 that will close this issue
Draft
@glyph
Copy link
Member

glyph commented Sep 25, 2023

(At some point it would be nice to do the ctap2 client work on this too…)

@adiroiban
Copy link
Member Author

well... one step at a time.

I got a draft PR for the server-side implementation... just a weekend hacking session.

but I would like to have a coding buddy / review partner to continue working on this.

I expect that many people using conch ssh client are using it for non-human / automated processes ... so the FIDO2 is not that important / relevant.

@glyph do you have an use case for client-side SSH with FIDO2 and Twisted, are you aware of any human interacting client-side SSH app using Twisted

For server-side, I think that Launchpad is/was using Twisted concn for some SFTP /SSH handling for PPA.
And I have a SCP/SFTP server using Twisted conch, that might receive SSH connections driven by a person, and not by an automated process.

@glyph
Copy link
Member

glyph commented Sep 26, 2023

@glyph do you have an use case for client-side SSH with FIDO2 and Twisted, are you aware of any human interacting client-side SSH app using Twisted

Many years ago, https://www.expandrive.com was based on Conch. I think have long since rewritten it, but there are lots of possible interactive applications like that which might want to speak SSH or SFTP.

Personally though, I just want to use less software written in C, so I use the conch built-in SSH client whenever I can. OpenSSH obviously has a lot more maintainers and a lot more features, but for most uses conch is fine!

@cjwatson
Copy link
Contributor

While I don't currently have time to help with this, I agree that Launchpad would definitely be able to make good use of server-side support here (at least once we get off Python 3.5 and so can upgrade Twisted again, which is nearly done ...).

@glyph
Copy link
Member

glyph commented Sep 26, 2023

While I don't currently have time to help with this,

Maybe just make sure any interested colleagues are aware that this work is underway, just in case anyone has a free moment 😄

@cjwatson
Copy link
Contributor

Maybe just make sure any interested colleagues are aware that this work is underway, just in case anyone has a free moment 😄

Done!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

#12001 Add OpenSSH FIDO2 security key support for server-side auth twisted/twisted
3 participants
@adiroiban @glyph @cjwatson