1

I'm trying to use SSH using signed certificates. I'm using ssh -i keys/client.key to connect to the target device. If I generate a public key from that private key (with ssh-keygen -y -f keys/client.key) and place that in the .ssh/authorized_keys file I'm able to connect with no issue.

What I'm trying to do is use the CA to allow all keys signed by that CA to log in as that user. I used ssh-keygen -y -f keys/ca.key to generate a public key and put it into authorized_keys as "cert-authority sh-rsa AAAB3N.....Z". My understanding from different sites is that it should now "work", except that it doesn't. On the client side I just get "Permission denied (publickey).". I have no other listings in the authorized_keys file. On the server side I don't get any error message and only a message that the client disconnected.

Am I missing something simple? How can I debug why it's not working.

Edit #1

I generated the private keys with EasyRSA which is some shell scripts over openssl calls. I think the issue may be that the private key was generated, then a CSR, then a signed certificate. Therefore, I don't think the private key is "signed" in any sort of fashion.

Edit #2

I tried ssh-keygen -s ca.key -I key client.key and I get 'do_ca_sign: unable to open "client.key"'. I tried it with a freshly generated RSA key made by ssh-keygen and it worked fine so the ca.key seems to be okay. I'm thinking there's something about the openssl generated private key that it doesn't like.

Improve this question
4
  • The openssl tag is inappropriate for this question. – aecolley Jan 23 '15 at 23:07
  • I used openssl to generate the keys... – Tim Tisdall Jan 23 '15 at 23:26
  • SSH private keys are stored in PEM format, but everything else (public keys and certificates) have a nonstandard format. It's very unusual to use openssl to manipulate SSH structures; I recommend using ssh-keygen for such tasks. – aecolley Jan 25 '15 at 0:19
  • All the devices had existing keys for another purpose. I wanted to reuse those keys instead of having to have 2 keys per device. – Tim Tisdall Jan 25 '15 at 0:22
1
  1. Your client is not presenting a certificate, because it doesn't have one. You need to generate one (ssh-keygen -s keys/ca.key -I jruser -n jruser keys/client.key.pub). The new certificate (keys/client.key_cert.pub) will automatically be picked up by ssh and presented to the server.
  2. Your cert-authority line in authorized_keys lacks the required principals assignment (e.g. principals="jruser").
  3. To debug it, you can use ssh -v as usual. The authentication algorithms have "cert" in their names when certificate authentication is being used.
  4. I suggest using the TrustedUserCAKeys option (in sshd_config) instead of writing cert-authority lines, because it's the older and more well-tested form of ssh user certificates.

A good concise guide to setting this up (and host key certificates as well) is How To Create an SSH CA to Validate Hosts and Clients with Ubuntu.

Improve this answer
2
  • #1 is wrong. I said in my first paragraph that I'm having no issue using my private key and using the public key in .ssh/authorized_keys . – Tim Tisdall Jan 23 '15 at 23:12
  • ah, wait.. I think I see what you're saying now. I was confusing the private key with the certificate. – Tim Tisdall Jan 24 '15 at 2:29
0

There seems to be multiple issues going on here...

The primary confusion is that you sign public keys and not private keys. If you try to sign a private key named "id_rsa" ssh-keygen will just ignore that and use "id_rsa.pub" in the same directory. If that public key isn't there, it just gives you the same error message if you tried signing a file that didn't exist.

Also, when signing in, if you use a private key called "some.key", your signed public key needs to be called "some.key-cert.pub" and be in the same directory or else it won't use that and the whole thing doesn't work.

As for "principals"... If you have them (they're optional), they specify what users you can actually log in as. So, if you sign the public key with principals then you can only use that to sign in as those users.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.