Hi,
I'm trying to work on the publickey authorization database in lshd. I'd like
to ask for comments how to implement it.
Goals:
* in the long term, support SPKI style certificates and acls to grant
permissions to certain parts of the system
* in the shorter term, support ssh2 publickey authentication with ssh2
keyblobs, possibly using spki style keys outside the protocol.
* granting permission should be as easy as with ssh1 (e.g. copying a public
key file to a certain directory)
Currently, as a publickey authentication request is received, the ssh2
keyblob (coming in the auth request) is converted to an SPKI S-expression,
the canonical form of this S-expression is hashed, and the value of the
hash is taken as a filename and checked for in the ~/lsh/authorization
directory. This scheme is not general enough to support several publickey
methods (e.g. real SPKI, OpenPGP, and SSH2)
There are at least two different ways I see the above implementable:
1) publickey methods are not interchangeable, meaning that you can't use an
ssh2 key for authenticating using the SPKI method (e.g. internal
conversions are not done, and several authorization database exists, one for
each method)
2) publickey methods are interchangeable as much as possible, only one
authorization database exists, keyconversions are done automatically (and
blindly)
I for one would go for #1, and provide a program to convert keys from one
format to another. The authorization database would look like:
~/.lsh/authorization/ssh-dss - for ssh-dss public keys, in ssh keyblob format
~/.lsh/authorization/spki - for spki acl s-expressions
~/.lsh/authorization/openpgp - for openpgp public keys
What do you think?
--
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
url: http://www.balabit.hu/pgpkey.txt
