jakob / jakob/Postico

Unable to authenticate when using an SSH key which was signed by an SSH CA

Open
#675 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
485
Forks
8
PR merge metrics
No merged PRs in 30d

Description

## Background

* SSH has support for a certificate authority _(CA)_ as a means of authenticating users.

### Enable SSH CA authentication on server
* To enable the SSH CA, you generate an ssh key to be the CA
```bash
ssh-keygen -f user_ca -C user_ca
```
* Then copy the public key of the CA to the target server
* And add the `TrustedUserCAKeys` configuration option to `/etc/ssh/sshd_config`
```
TrustedUserCAKeys /etc/ssh/user_ca.pub
```

### Generate an sign a client key
* For client keys to be authenticated using the new CA public key, the client SSH key must be signed by the CA Key.
* Generate the key:
```bash
ssh-keygen \
-f username \
-I username \
-C username
```
* Then sign the key:
```bash
ssh-keygen \
-s user_ca \
-I username \
-n username \
-V -1w:+365d \
username
```
* Then use the resulting ssh key to connect to the target host:
```bash
ssh -i username username@server
```

## What did you do?

- In Postico
- **Edit a connection**
- Click on **Options**
- Check **Connect via SSH**
- Enter an SSH host: `server`
- Enter a User: `username`
- _No password_
- Choose the Private Key signed by the ca: `username`

## What did you expect to happen?

- A successful tunnel established.

## What actually happened?

- Error message stating: `The SSH server rejected the private key.`

## What software versions are you using?

- Postico version: `1.5.8`
- macOS version: `10.14.4` _(Mojave)_

Contributor guide

No contributing guide indexed for this repository

Research direction

No source files or tests are named. Start by reproducing the Postico SSH tunnel flow with the CA-signed key and inspect the private-key authentication path; done means a connection using the selected signed key establishes the tunnel successfully instead of reporting that the server rejected it.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.