Restrict SSH CA certificates to specific users/groups
Clash Royale CLAN TAG#URR8PPP
up vote
0
down vote
favorite
Is it possible to restrict the use of CA certificates to specific users/principals/groups?
The use case is that I'd like to have 2 CA certificates. One would be used as part of an automated system to sign user keys. If this certificate were to be compromised, I want to be sure that it couldn't be used to allow someone to log into an admin account.
The other CA certificate would obviously be more securely stored (airgapped etc.) and used for admin accounts.
ssh openssh certificates
asked Jan 13 at 16:26
Sam Bull
1053
add a comment |Â
up vote
0
down vote
favorite
Is it possible to restrict the use of CA certificates to specific users/principals/groups?
The use case is that I'd like to have 2 CA certificates. One would be used as part of an automated system to sign user keys. If this certificate were to be compromised, I want to be sure that it couldn't be used to allow someone to log into an admin account.
The other CA certificate would obviously be more securely stored (airgapped etc.) and used for admin accounts.
ssh openssh certificates
asked Jan 13 at 16:26
Sam Bull
1053
Just so I understand: you want to make sure that if CA1 erroneously certifies a public key for userroot, it still would not work?
– Ulrich Schwarz
Jan 13 at 18:14
1
According to sshd docs,TrustedUserCAKeysis valid inMatchsections, so I think thatMatch User rootshould work?
– Ulrich Schwarz
Jan 13 at 18:18
add a comment |Â
up vote
0
down vote
favorite
up vote
0
down vote
favorite
Is it possible to restrict the use of CA certificates to specific users/principals/groups?
The use case is that I'd like to have 2 CA certificates. One would be used as part of an automated system to sign user keys. If this certificate were to be compromised, I want to be sure that it couldn't be used to allow someone to log into an admin account.
The other CA certificate would obviously be more securely stored (airgapped etc.) and used for admin accounts.
ssh openssh certificates
asked Jan 13 at 16:26
Sam Bull
1053
Is it possible to restrict the use of CA certificates to specific users/principals/groups?
The use case is that I'd like to have 2 CA certificates. One would be used as part of an automated system to sign user keys. If this certificate were to be compromised, I want to be sure that it couldn't be used to allow someone to log into an admin account.
The other CA certificate would obviously be more securely stored (airgapped etc.) and used for admin accounts.
ssh openssh certificates
asked Jan 13 at 16:26
Sam Bull
1053
asked Jan 13 at 16:26
Sam Bull
1053
asked Jan 13 at 16:26
Sam Bull
1053
asked Jan 13 at 16:26
Sam Bull
1053
1053
Just so I understand: you want to make sure that if CA1 erroneously certifies a public key for userroot, it still would not work?
– Ulrich Schwarz
Jan 13 at 18:14
1
According to sshd docs,TrustedUserCAKeysis valid inMatchsections, so I think thatMatch User rootshould work?
– Ulrich Schwarz
Jan 13 at 18:18
add a comment |Â
Just so I understand: you want to make sure that if CA1 erroneously certifies a public key for userroot, it still would not work?
– Ulrich Schwarz
Jan 13 at 18:14
1
According to sshd docs,TrustedUserCAKeysis valid inMatchsections, so I think thatMatch User rootshould work?
– Ulrich Schwarz
Jan 13 at 18:18
Just so I understand: you want to make sure that if CA1 erroneously certifies a public key for user
root, it still would not work?– Ulrich Schwarz
Jan 13 at 18:14
Just so I understand: you want to make sure that if CA1 erroneously certifies a public key for user
root, it still would not work?– Ulrich Schwarz
Jan 13 at 18:14
1
1
According to sshd docs,
TrustedUserCAKeys is valid in Match sections, so I think that Match User root should work?– Ulrich Schwarz
Jan 13 at 18:18
According to sshd docs,
TrustedUserCAKeys is valid in Match sections, so I think that Match User root should work?– Ulrich Schwarz
Jan 13 at 18:18
add a comment |Â
1 Answer
1
active
oldest
votes
up vote
0
down vote
accepted
Based on Ulrich Schwarz's comment:
If I add normal users to an endusers group, then I can set the sshd_config like this:
TrustedUserCAKeys /etc/ssh/admin_ca.pub
Match Group endusers
TrustedUserCAKeys /etc/ssh/user_ca.pub
This results in the user_ca only being accepted for users in the endusers group, while the admin_ca can be used for any user.
answered Jan 14 at 13:53
Sam Bull
1053
But you do not have to match the normal users for the protection you asked for but the admin accounts.
– Hauke Laging
Jan 14 at 15:53
Both works. But, I'd rather restrict the less secure CA to a specific group of restricted users. That way I can be certain that this CA will never be used to log into any other account that may have less restrictions (admin or otherwise).
– Sam Bull
Jan 14 at 20:38
add a comment |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
accepted
Based on Ulrich Schwarz's comment:
If I add normal users to an endusers group, then I can set the sshd_config like this:
TrustedUserCAKeys /etc/ssh/admin_ca.pub
Match Group endusers
TrustedUserCAKeys /etc/ssh/user_ca.pub
This results in the user_ca only being accepted for users in the endusers group, while the admin_ca can be used for any user.
answered Jan 14 at 13:53
Sam Bull
1053
But you do not have to match the normal users for the protection you asked for but the admin accounts.
– Hauke Laging
Jan 14 at 15:53
Both works. But, I'd rather restrict the less secure CA to a specific group of restricted users. That way I can be certain that this CA will never be used to log into any other account that may have less restrictions (admin or otherwise).
– Sam Bull
Jan 14 at 20:38
add a comment |Â
up vote
0
down vote
accepted
Based on Ulrich Schwarz's comment:
If I add normal users to an endusers group, then I can set the sshd_config like this:
TrustedUserCAKeys /etc/ssh/admin_ca.pub
Match Group endusers
TrustedUserCAKeys /etc/ssh/user_ca.pub
This results in the user_ca only being accepted for users in the endusers group, while the admin_ca can be used for any user.
answered Jan 14 at 13:53
Sam Bull
1053
But you do not have to match the normal users for the protection you asked for but the admin accounts.
– Hauke Laging
Jan 14 at 15:53
Both works. But, I'd rather restrict the less secure CA to a specific group of restricted users. That way I can be certain that this CA will never be used to log into any other account that may have less restrictions (admin or otherwise).
– Sam Bull
Jan 14 at 20:38
add a comment |Â
up vote
0
down vote
accepted
up vote
0
down vote
accepted
Based on Ulrich Schwarz's comment:
If I add normal users to an endusers group, then I can set the sshd_config like this:
TrustedUserCAKeys /etc/ssh/admin_ca.pub
Match Group endusers
TrustedUserCAKeys /etc/ssh/user_ca.pub
This results in the user_ca only being accepted for users in the endusers group, while the admin_ca can be used for any user.
answered Jan 14 at 13:53
Sam Bull
1053
Based on Ulrich Schwarz's comment:
If I add normal users to an endusers group, then I can set the sshd_config like this:
TrustedUserCAKeys /etc/ssh/admin_ca.pub
Match Group endusers
TrustedUserCAKeys /etc/ssh/user_ca.pub
This results in the user_ca only being accepted for users in the endusers group, while the admin_ca can be used for any user.
answered Jan 14 at 13:53
Sam Bull
1053
edited Jan 14 at 14:01
answered Jan 14 at 13:53
Sam Bull
1053
answered Jan 14 at 13:53
Sam Bull
1053
answered Jan 14 at 13:53
Sam Bull
1053
1053
But you do not have to match the normal users for the protection you asked for but the admin accounts.
– Hauke Laging
Jan 14 at 15:53
Both works. But, I'd rather restrict the less secure CA to a specific group of restricted users. That way I can be certain that this CA will never be used to log into any other account that may have less restrictions (admin or otherwise).
– Sam Bull
Jan 14 at 20:38
add a comment |Â
But you do not have to match the normal users for the protection you asked for but the admin accounts.
– Hauke Laging
Jan 14 at 15:53
Both works. But, I'd rather restrict the less secure CA to a specific group of restricted users. That way I can be certain that this CA will never be used to log into any other account that may have less restrictions (admin or otherwise).
– Sam Bull
Jan 14 at 20:38
But you do not have to match the normal users for the protection you asked for but the admin accounts.
– Hauke Laging
Jan 14 at 15:53
But you do not have to match the normal users for the protection you asked for but the admin accounts.
– Hauke Laging
Jan 14 at 15:53
Both works. But, I'd rather restrict the less secure CA to a specific group of restricted users. That way I can be certain that this CA will never be used to log into any other account that may have less restrictions (admin or otherwise).
– Sam Bull
Jan 14 at 20:38
Both works. But, I'd rather restrict the less secure CA to a specific group of restricted users. That way I can be certain that this CA will never be used to log into any other account that may have less restrictions (admin or otherwise).
– Sam Bull
Jan 14 at 20:38
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f416847%2frestrict-ssh-ca-certificates-to-specific-users-groups%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Just so I understand: you want to make sure that if CA1 erroneously certifies a public key for user
root, it still would not work?– Ulrich Schwarz
Jan 13 at 18:14
1
According to sshd docs,
TrustedUserCAKeysis valid inMatchsections, so I think thatMatch User rootshould work?– Ulrich Schwarz
Jan 13 at 18:18