hashicorp / hashicorp/vault

SSH signer support for PuTTy format

Open
#31,463 0 comments 0 reactions 0 assignees View on GitHub
enhancement secret/ssh
Dominant language
Go
Stars
36.3k
Forks
4.8k
PR merge metrics
PR metrics pending

Description

Feature request

The [vault ssh signer](https://developer.hashicorp.com/vault/docs/secrets/ssh/signed-ssh-certificates) currently outputs SSH certificates in OpenSSH format. On Windows, it would be convenient for it to be able to also provide the PuTTy SSH certificate format (which is the PuTTy Pubkey format aka RFC4716).

Something like:
```powershell
vault write -field=signed_key_rfc4716 ssh-client-signer/sign/default public_key="$pubkey"
```
...to produce:
```
---- BEGIN SSH2 PUBLIC KEY ----
AAAAB3NzaC1yc2EAAAABIwAAAIEA1on8gxCGJJWSRT4uOrR13mUaUk0hRf4RzxSZ1zRb
YYFw8pfGesIFoEuVth4HKyF8k1y4mRUnYHP1XNMNMJl1JcEArC2asV8sHf6zSPVffozZ
5TT4SfsUu/iKy9lUcCfXzwre4WWZSXXcPff+EHtWshahu3WzBdnGxm5Xoi89zcE=
---- END SSH2 PUBLIC KEY ----
```

It is possible to convert this currently using a small powershell script, but this requires the user to keep the script on hand.

Contributor guide

Open the contributing guide

Research direction

Start with the vault ssh signer endpoint and the existing OpenSSH certificate output described in the issue. Use the example vault write command and RFC4716 sample as the behavior to compare against. Done means the signer can return a PuTTY/RFC4716-formatted certificate through the requested field without requiring a separate PowerShell conversion.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.