keybase / keybase/client

[feature request] distributing ssh public keys via keybase

Open
#14,873 0 comments 3 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
9.2k
Forks
1.3k
Avg merge
12h 58m
Merged PRs (30d)
56

Description

This would give sysadmins a secure way of giving another admin access to a server via ssh keys.

How I imagine this could work:
- User A wants to give user B access to his server via ssh-key authorization
- User B previously added his ssh public key and an ownership signature to his keybase proofs

- Possibility 1 (more secure, more work)

- User A runs `keybase ssh pull && keybase ssh export b_authorized_keys` on his machine, then copies `b_authorized_keys` to `/home/b/.ssh/authorized_keys` on the server
- This would use whatever cryptographic attack countermeasures are enabled by following a user

- Possibility 2 (less secure, less work)

- User A runs `keybase ssh pull && keybase ssh import-id ` on the server

- Possibility 3 (same as 2, but using a stripped-down ssh-import-only client)

- User A installs `ssh-import-id-kb` (basically following the pattern of `ssh-import-id-gh`, etc) on the server and runs `ssh-import-id-kb ` on the server

- Final result: User B can now authenticate on the server using his SSH key that was securely fetched over keybase

Things left to consider:
- How and when to revoke keys (ex: user B revokes ssh-key 2, should it get removed the next time the keys are re-imported?)

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing the existing keybase SSH-related commands and the keybase proofs flow described in the issue. Compare the three proposed workflows, then define how public-key retrieval, ownership verification, and revocation should behave. Done means one supported workflow securely places a user's key in authorized_keys and specifies how revoked keys are removed.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, cli, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.