[feature request] distributing ssh public keys via keybase
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- Avg merge
- 12h 58m
- Merged PRs (30d)
- 56
Description
This would give sysadmins a secure way of giving another admin access to a server via ssh keys.
How I imagine this could work:
- User A wants to give user B access to his server via ssh-key authorization
- User B previously added his ssh public key and an ownership signature to his keybase proofs
- Possibility 1 (more secure, more work)
- User A runs `keybase ssh pull && keybase ssh export b_authorized_keys` on his machine, then copies `b_authorized_keys` to `/home/b/.ssh/authorized_keys` on the server
- This would use whatever cryptographic attack countermeasures are enabled by following a user
- Possibility 2 (less secure, less work)
- User A runs `keybase ssh pull && keybase ssh import-id ` on the server
- Possibility 3 (same as 2, but using a stripped-down ssh-import-only client)
- User A installs `ssh-import-id-kb` (basically following the pattern of `ssh-import-id-gh`, etc) on the server and runs `ssh-import-id-kb ` on the server
- Final result: User B can now authenticate on the server using his SSH key that was securely fetched over keybase
Things left to consider:
- How and when to revoke keys (ex: user B revokes ssh-key 2, should it get removed the next time the keys are re-imported?)
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing the existing keybase SSH-related commands and the keybase proofs flow described in the issue. Compare the three proposed workflows, then define how public-key retrieval, ownership verification, and revocation should behave. Done means one supported workflow securely places a user's key in authorized_keys and specifies how revoked keys are removed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100