Hacker News Reader

Comment by capableweb | Hacker News Reader

In that vein, is there something that could allow me to manage authorized_keys via DNS? Let's say I own capableweb.com, I'd love it if sshd could just read all records from keys.capableweb.com and use those as valid public keys.

I have bunch of personal servers, and bunch of keys in use, many of the servers are not automated (they're pets, not cattle), so when I rotate keys, it's sometimes a hassle.

Mostly asking just because it'd be fun.

View on HN

As mentioned elsewhere in this thread, actually using SSHFP in a secure way is difficult.

Far better is to use SSH host certificates, then your known_hosts can simply have a @cert-authority * some-cert in it. (See https://www.lorier.net/docs/ssh-ca.html)

AuthorizedKeysCommand is what you are looking for.

https://man.openbsd.org/sshd_config#AuthorizedKeysCommand

That is indeed what seems to be the most useful out of all the replies, thanks a lot!

Be warned that when using this a lot of the security comes down to your own implementation of that command.

The suggested alternative using certificates is a much more standard way that has less ways to create holes in your security.

Maybe I'm missing something obvious, but seems to be much more up to the security of my DNS setup rather than the command.

The command would basically hit "keys.my-domain.example" and return the values of each TXT record. Not sure what could go wrong here, besides if I lose DNS access, I won't have access to the boxes. Probably add some sort of caching as well for that.

But otherwise, it seems to be much more about the security of what goes into "keys.my-domain.example".

That's what I meant. Just looking up a DNS record as an implementation sounds like a bad idea. You would have to set up thinks like DNSSec validation, and consider all the ways in which that could fail.

The cleanest way in your use case would be to store keys in an LDAP server instead of local users' authorized_keys You can plug any of your server to this LDAP and enjoy the same users and keys everywhere.

If you trust GitHub you could curl https://github.com/capableweb.keys on startup

I’ve set up an AuthorizedKeysCommand that uses unbound to get the authorized keys for the server via DNSSEC, with the ability to specify keys for whole servers, users on servers or globally for all servers. This is pretty neat for my few private boxes, I wouldn’t advise it for something bigger or enterprise, an ldap or similar seems better for that.

People scaling SSH authorization tend to set up SSH CAs (either directly, or baked into some higher-level management solution). SSH CAs scale down nicely, as well.

An SSH certificate authority is what I’d choose for that. Can work with both user keys and host keys. The host certs have a field for demonstrating their hostname; the user certs have a field restricting their username. So, as the certificate authority you have a little more power than what you can distribute via DNS.

Similar idea: This runs as a cron/systemd timer and updates your authorized_keys from your GitHub account.

https://github.com/shoenig/ssh-key-sync

https://github.com/samber/sync-ssh-keys/

There are also 'free for personal' use commercial systems that work in a similar way to some of the suggestions posted in the comments:

https://www.keystash.io

You might consider checking in an authorized_keys file? Not as fun as dns, but maybe easier. You can use ssh-keyscan to build the file.

A tiny bash script and a cronjob

Reply on news.ycombinator.com