Unable to authenticate when using an SSH key which was signed by an SSH CA
- Dominant language
- Python
- Stars
- 485
- Forks
- 8
- PR merge metrics
- No merged PRs in 30d
Description
## Background
* SSH has support for a certificate authority _(CA)_ as a means of authenticating users.
### Enable SSH CA authentication on server
* To enable the SSH CA, you generate an ssh key to be the CA
```bash
ssh-keygen -f user_ca -C user_ca
```
* Then copy the public key of the CA to the target server
* And add the `TrustedUserCAKeys` configuration option to `/etc/ssh/sshd_config`
```
TrustedUserCAKeys /etc/ssh/user_ca.pub
```
### Generate an sign a client key
* For client keys to be authenticated using the new CA public key, the client SSH key must be signed by the CA Key.
* Generate the key:
```bash
ssh-keygen \
-f username \
-I username \
-C username
```
* Then sign the key:
```bash
ssh-keygen \
-s user_ca \
-I username \
-n username \
-V -1w:+365d \
username
```
* Then use the resulting ssh key to connect to the target host:
```bash
ssh -i username username@server
```
## What did you do?
- In Postico
- **Edit a connection**
- Click on **Options**
- Check **Connect via SSH**
- Enter an SSH host: `server`
- Enter a User: `username`
- _No password_
- Choose the Private Key signed by the ca: `username`
## What did you expect to happen?
- A successful tunnel established.
## What actually happened?
- Error message stating: `The SSH server rejected the private key.`
## What software versions are you using?
- Postico version: `1.5.8`
- macOS version: `10.14.4` _(Mojave)_
Contributor guide
No contributing guide indexed for this repository
Research direction
No source files or tests are named. Start by reproducing the Postico SSH tunnel flow with the CA-signed key and inspect the private-key authentication path; done means a connection using the selected signed key establishes the tunnel successfully instead of reporting that the server rejected it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 38/100