README
¶
sshaclsrv
A minimal implementation for a role-based key distribution framework for OpenSSH (node-side).
sshaclsrv utilises OpenSSH's AuthorizedKeysCommand to look up authorized keys remotely, with local fallback.
Keys can be matched to the hostname with patterns, and keys can also carry an expiration time.
sshaclsrv is used as AuthorizedKeysCommand and parses a keyfile containing:
- Hostname on which the key is valid (can contain '*' for matching).
- SystemUser as which to authenticate.
- The SHA256 hash of the user/node that is connecting.
- ExpireTime, optional. YYYYMMDDHHmmSS.
- AuthorizedKeys entry to return on match, which must contain the key and can contain additional options for sshd.
Remote key repositories are standard HTTP file servers, using the URL to match the keys. Urls have the format:
http(s)://<fqdn/path>/key/<sshfingerprint>/<hostname>/<systemuser>
Returned entries are one key per line. Remote entries require a signature that is created by delegatesign. Delegated signatures allow delegating authority for a limited time to a third party, without having to update the on-node configuration of sshaclsrv.
If a remote lookup fails (other than with status 404) or times out (5 seconds), the local file will be consulted.
Calls to HTTP backend support optional authentication (via Basic Auth only to support dumb fileserving).
OpenSSH config:
/etc/ssh/sshd_config
Match Group aclusers
AuthorizedKeysFile /etc/ssh/empty
AuthorizedKeysCommand /usr/local/libexec/sshacl/sshaclsrv -c /etc/ssh/acl.cfg -u %u -f %f
AuthorizedKeysCommandUser sshacl
Create group and capture system users to be managed:
$ groupadd aclusers
$ usermod -a -G aclusers <systemuser to manage>
Correctly updating the keyfile:
$ mv new-keyfile keyfile
Please be aware that both the sshaclsrv config file and key file may only be writeable by root or the process owner.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
src
|
|
|
delegatesign
Package delegatesign contains delegated signing functionality.
|
Package delegatesign contains delegated signing functionality. |
|
fileperm
Package fileperm contains functions to check permissions on files.
|
Package fileperm contains functions to check permissions on files. |
|
gosshacl
Package gosshacl implements file based access control for SSH (authorizedkeyscommand).
|
Package gosshacl implements file based access control for SSH (authorizedkeyscommand). |
|
hostmatch
Package hostmatch implements simple wildcard matching for hostnames.
|
Package hostmatch implements simple wildcard matching for hostnames. |
|
model
Package model implements an access definition model for SSH authentication.
|
Package model implements an access definition model for SSH authentication. |
|
sshkey
Package sshkey implements parsing of SSH keys (authorized-keys format) and filtering of options.
|
Package sshkey implements parsing of SSH keys (authorized-keys format) and filtering of options. |
|
stringduration
Package stringduration extends formatting for durations as strings.
|
Package stringduration extends formatting for durations as strings. |