Evolution of SSH with OpenId Connect
Marcus Hardt, Diana Gudu, Gabriel Zachmann, Lukas Brocke · 2024
The Secure Shell Protocol (SSH) is the de-facto standard for accessing remote servers on the commandline. Use cases include remote system administration for unix administrators, git via ssh for developers, rsync via ssh for system backups, and HPC access for scientists. Unfortunately, there is no globally accepted usage pattern for federated usage yet. The large variety of users with different backgrounds and usage profiles motivated us to develop a set of different tools for facilitating the integration with federated user identities. The main novelty of our contribution is the integration of an ssh Certificate Authority (CA) into the existing motley-cue + oidc-agent mechanism via a toolchain that we call "oinit". It simplifies the usage of ssh certificates by leveraging authorisation information via established federation mechanisms. The benefit is that – after an initial setup step – ssh may be used securely without interrupting existing flows. This allows for example the use of rsync or git via ssh. To enable this, oinit consists of a collection of programs to enable OpenSSH login for federated identities based on certificates: • The oinit-ca provides a REST interface to an ssh-ca at which authorised users obtain an ssh certificate for a specified host or host group. Authorisation decisions are enforced by motley-cue, the component that maps federated identities to local ones on the ssh server side. User provisioning may also be triggered at this point, e.g. via motley-cue and feudal. • Users employ the oinit tool to add hosts to the oinit mechanism. Once established, ssh certificates will automatically be retrieved, whenever this may be necessary and stored in the ssh-agent. • Serverside tools and configuration for enabling ssh without knowledge of local usernames ("non-username operation"), which is particularly useful in federated scenarios. In this paper we outline the basic solution and focus on on user interface optimisation with the integration of ssh certificates. Source code modifications of ssh are prohibitive and are not necessary with the solution described in this paper.