Hacker Newsnew | past | comments | ask | show | jobs | submit | moviuro's commentslogin

All those articles about SSH certificates fall short of explaining how the revocation list can/should be published.

Is that yet another problem that I need to solve with syncthing?

https://man.openbsd.org/ssh-keygen.1#KEY_REVOCATION_LISTS


If you generate short lived certificates via an automated process/service then you don’t really need to manage a revocation list as they will have expired in short order.


But then you can't log in if your box goes offline for any reason.


Hmm. For user certs you can have the service sign them for, say an hour, so long as you can ssh to your server in that time then there’s no need for any other interaction.

Sure you need your signing service to be reasonably available, but that’s easily accomplished.

Maybe I misunderstand?


That works for authn in the happy path: short-lived cert, grab it, connect, done.

Except for everything around that:

* user lifecycle (create/remove/rename accounts)

* authz (who gets sudo, what groups, per-host differences)

* cleanup (what happens when someone leaves)

* visibility (what state is this box actually in right now?)

SSH certs don’t really touch any of that. They answer can this key log in right now, not what should exist on this machine.

So in practice, something else ends up managing users, groups, sudoers, home dirs, etc. Now there are two systems that both have to be correct.

On the availability point: "reasonably available" is doing a lot of work ;)

Even with 1-hour certs:

* new sessions depend on the signer

* fleet-wide issues hit everything at once

* incident response gets awkward if the signer is part of the blast radius

The failure mode shifts from a few boxes don't work to nobody can get in anywhere

The pull model just leans the other way:

* nodes converge to desired state

* access continues even if control plane hiccups

* authn and authz live together on the box

Both models can work - it’s more about which failure mode is tolerable to you.


Well, yes, pick your poison.

But for just getting access to role accounts then I find it a lot nicer than distributing public keys around.

And for everything else, a periodic Ansible :-)


Public keys (for OpenSSH) can be in DNS (VerifyHostKeyDNS) or in, say, LDAP via KnownHostsCommand and AuthorizedKeysCommand.


That sounds like a lot of extra steps. How do I validate the authenticity of a signing request? Should my signing machine be able to challenge the requester? (This means that the CA key is on a machine with network access!!)

Replacing the distribution of a revocation list with short-lived certificates just creates other problems that are not easier to solve. (Also, 1h is bonkers, even letsencrypt doesn't do it)


1h is bonkers for certs in https, but it's not unreasonable for authorized user certs, if your issuance path is available enough.

IMHO, if you're pushing revocation lists at low latency, you could also push authorized keys updates at low latency.


Honestly, we used to replace a lot of pam_ldap and similar sorts of awful solutions. With those, if your LDAP went down even for a heartbeat, you couldn't log in at all.

So I totally agree: if I had to do certificates and didn't have something like Userify, a 1 hour (or even shorter if possible) expiration seems quite worth chasing, especially with suitable highly available configuration. (Of course, TFA doesn't even bother mentioning revocation and expiration, which should give you a clue as to how much fun those are lol)

And for more normal, lower-security requirements or non-HA, 6 or 8 hours or so would probably work and give you plenty of time for even serious system outages before the certs expired.

Not to hard shill or anything (apologies in advance, just skip if you're not interested), but there are two significant security and reliability differences between standard SSH (with or without certificates) and Userify:

1. Userify Cloud updates by default every three minutes, and on-premise Userify Express/Enterprise updates every ten seconds, but it doesn't have to update at all; even if your Userify server goes offline forever, you can still log in because the accounts are standard UNIX accounts (literally created with `useradd`)

2. When accounts are removed, Userify also completely nukes the user account, removes its sudo perms, and totally kill -9 's any tmux/screen/etc sessions (all processes owned by the user are terminated across the entire enterprise within seconds), which is also not something that a certificate expiration would ever do.


Search forums local to your country and write documentation on how to use Linux or BSD as a modem.

For OpenBSD on Orange France FTTH: https://lafibre.info/remplacer-livebox/remplacer-sa-livebox-... or https://try.popho.be/securing-home2.html


That link forever hangs for me :-(

The last time I searched for open hardware, even the implementations running Linux on a desktop PC with a caux adapter were not DOCSIS 3.X compatible.

The companies that multiplex the signal down the cables keep updating their standards, both a blessing (for speed) and a curse for maintained code




It's a very rare race condition, odds are very low that you were impacted. If you were, you would have noticed (heavy builds with files being moved around where suddenly files are zero).

[0] https://bugs.gentoo.org/917224

[1] https://github.com/openzfs/zfs/issues/15526 (referenced in the article)


See the explanation on the blog itself [0]

[0] https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQ...


Wow... that is pretty janky.


> The signals required a lot of patience to learn and I'm not entirely sure I still understand them.

Chain signals before an intersection; regular signals after those, and on the track to split the track for multiple trains simultaneously.

See: https://wiki.factorio.com/Tutorial:Train_signals if you haven't already.


Another major stumbling block for train signals once you get the basics down is segment length. Signals indicate whether the next segment is occupied, not whether any given train will fit in there (and potentially block a segment or intersection behind it.)

I frequently set up tracks with segments as large as my longest train, but then end up having to add an intersection here or there, breaking up segments into smaller sizes. This is the root of most of my train woes (aside from LTN issues, which are a whole other issue!)


> Signals indicate whether the next segment is occupied, not whether any given train will fit in there (and potentially block a segment or intersection behind it.)

That's what chain signals are for. If a train waiting at a signal causes issues, replace the previous signal with a chain signal to prevent the train from problematically waiting at the signal.


> they lose the master password

The threat model for every lambda user having a password manager does not cover breaking and entering[0]: they should write down their master password and keep it at home in their bedroom drawer.

Use biometrics where possible (e.g. bitwarden on Android has that option)

[0] maybe it does for you, working on some DoD-confidential docs, but your computer-illiterate aunt doesn't.


I did that for my mother.

She lost it anyway. TWICE.

As for bio-metrics they are not possible on all devices, and some software will require you to enter the master password once in a while even if it's activated.

But even if it was not the case, if you loose your device, you need to setup the new one, and for that, you need the master password or have backups.

Back to square one.


It's only now added as an interactive step in the install script. It has ~always been possible to create a crypto device with the install medium by dropping to a shell: https://www.openbsd.org/faq/faq14.html#softraidFDE


> You can stack storage to your heart's content

Unless you actually hit the maximum your building can sustain (heat, volume). Building datacenters is incredibly expensive, so reusing existing infrastructure and packing it with more is actually important.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: