[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: SSH w/ pre-shared key *and* password authentication



Kyle Pointer asked on 12/29/2008:
SSH with pre-shared key *and* password authentication. How does *that* work?

My main goal is to setup my ssh server so that it requires a client to
have a username, a password, and a pre-shared key...

Google for "ssh multiple authentication".

The short answer is: No, not without some patching.

http://www.nabble.com/Requiring-multiple-authentication-td19459436.html
https://bugzilla.mindrot.org/show_bug.cgi?id=983
https://bugzilla.mindrot.org/show_bug.cgi?id=1435
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=195716

You should also realize that the end user will likely have a password to protect access to their private key.

And if this is PCI-DSS related, an asymmetric key pair with password-protected private key is considered sufficient to meet the criteria for "two-factor" authentication.

However, like all PKI architectures, every single one of them provides no assertions as to private key management, which, IMHO, is a huge and fundamental flaw.

i.e. There is no way for a recipient of a public key (PGP, X.509 or otherwise) to validate an assertion like password length/complexity requirements, dual-control, or an FIPS 140-2 Level 3 HSM has been implemented for storage and access controls to the private key.

In other words, if your public key is posted on the internet in the clear, I would have no trust in anyone presenting your public key and asserting that they are, in fact, you.

I would have some trust if you had a non-empty password protecting access to that private key.

I would have more if you had a strong password.

I would have even more trust in your credentials if you generated your private key within a FIPS 140-2 Level 3 HSM.

But all systems currently available provide no such ability to either make or validate such assertions (just to make sure you don't have a strong password to obtain the credential, and then remove it later).

Seems kind of odd when the entire focus and basis of public key infrastructures (PKIs) is on the control of access to and use of the private key, don'tcha think?

Mike808
--
Yesterday is history. Tomorrow is a mystery. Today is a gift.
That is why it is called "the present". -- Master Oogway, Kung Fu Panda