Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

开源 OpenPubkey SSH (OPKSSH)：将单点登录集成到 SSH 中

OPKSSH makes it easy to SSH with single sign-on technologies like OpenID Connect, thereby removing the need to manually manage and configure SSH keys. It does this without adding a trusted party other than your identity provider (IdP). We are excited to announce OPKSSH (OpenPubkey SSH) has been open-sourced under the umbrella of the OpenPubkey project. While the underlying protocol OpenPubkey became an open source Linux foundation project in 2023, OPKSSH was closed source and owned by BastionZero (now Cloudflare). Cloudflare has gifted this code to the OpenPubkey project, making it open source. In this post, we describe what OPKSSH is, how it simplifies SSH management, and what OPKSSH being open source means for you.

OPKSSH 让使用 OpenID Connect 等单点登录 (SSO) 技术进行 SSH 连接变得简单，从而无需手动管理和配置 SSH 密钥。它在实现这一点的同时，除了您的身份提供商 (IdP) 外，无需增加任何受信任的第三方。我们很高兴地宣布，OPKSSH (OpenPubkey SSH) 已在 OpenPubkey 项目旗下开源。虽然其底层协议 OpenPubkey 已于 2023 年成为 Linux 基金会的开源项目，但 OPKSSH 此前一直由 BastionZero（现已被 Cloudflare 收购）闭源持有。Cloudflare 已将此代码捐赠给 OpenPubkey 项目，使其正式开源。在本文中，我们将介绍什么是 OPKSSH，它如何简化 SSH 管理，以及 OPKSSH 开源对您意味着什么。

Background

背景

A cornerstone of modern access control is single sign-on (SSO), where a user authenticates to an identity provider (IdP), and in response the IdP issues the user a token. The user can present this token to prove their identity, such as “Google says I am Alice”. SSO is the rare security technology that both increases convenience — users only need to sign in once to get access to many different systems — and increases security.

现代访问控制的基石是单点登录 (SSO)，用户在身份提供商 (IdP) 处进行身份验证，IdP 随后向用户颁发令牌。用户可以出示此令牌来证明其身份，例如“Google 证明我是 Alice”。SSO 是一种难得的安全技术，它既提高了便利性（用户只需登录一次即可访问多个不同系统），又增强了安全性。

OpenID Connect

OpenID Connect (OIDC) is the main protocol used for SSO. As shown below, in OIDC the IdP, called an OpenID Provider (OP), issues the user an ID Token which contains identity claims about the user, such as “email is alice@example.com”. These claims are digitally signed by the OP, so anyone who receives the ID Token can check that it really was issued by the OP. Unfortunately, while ID Tokens do include identity claims like name, organization, and email address, they do not include the user’s public key. This prevents them from being used to directly secure protocols like SSH or End-to-End Encrypted messaging. Note that throughout this post we use the term OpenID Provider (OP) rather than IdP, as OP specifies the exact type of IdP we are using, i.e., an OpenID IdP. We use Google as an example OP, but OpenID Connect works with Google, Azure, Okta, etc.

OpenID Connect (OIDC) 是用于 SSO 的主要协议。如下图所示，在 OIDC 中，IdP（称为 OpenID 提供商，即 OP）会向用户颁发一个 ID 令牌，其中包含有关用户的身份声明，例如“电子邮件是 alice@example.com”。这些声明由 OP 进行数字签名，因此任何收到 ID 令牌的人都可以验证它确实是由该 OP 颁发的。遗憾的是，虽然 ID 令牌确实包含姓名、组织和电子邮件地址等身份声明，但它们不包含用户的公钥。这使得它们无法直接用于保护 SSH 或端到端加密消息传递等协议。请注意，在本文中，我们使用 OpenID 提供商 (OP) 而不是 IdP，因为 OP 指定了我们正在使用的确切 IdP 类型，即 OpenID IdP。我们以 Google 为例，但 OpenID Connect 同样适用于 Google、Azure、Okta 等。

OpenPubkey

OpenPubkey, shown below, adds public keys to ID Tokens. This enables ID Tokens to be used like certificates, e.g. “Google says alice@example.com is using public key 0x123.” We call an ID token that contains a public key a PK Token. The beauty of OpenPubkey is that, unlike other approaches, OpenPubkey does not require any changes to existing SSO protocols and supports any OpenID Connect compliant OP. OpenPubkey enables ID Tokens to be used as certificates, OPKSSH extends this functionality so that these ID Tokens can be used as SSH keys in the SSH protocol. This adds SSO authentication to SSH without requiring changes to the SSH protocol.

OpenPubkey（如下图所示）将公钥添加到 ID 令牌中。这使得 ID 令牌可以像证书一样使用，例如“Google 证明 alice@example.com 正在使用公钥 0x123”。我们将包含公钥的 ID 令牌称为 PK 令牌。OpenPubkey 的精妙之处在于，与其他方法不同，它不需要对现有的 SSO 协议进行任何更改，并支持任何符合 OpenID Connect 标准的 OP。OpenPubkey 使 ID 令牌能够用作证书，而 OPKSSH 扩展了此功能，使得这些 ID 令牌可以在 SSH 协议中用作 SSH 密钥。这为 SSH 增加了 SSO 身份验证，且无需更改 SSH 协议本身。

Why this matters

为什么这很重要

OPKSSH frees users and administrators from the need to manage long-lived SSH keys, making SSH more secure and more convenient. “In many organizations – even very security-conscious organizations – there are many times more obsolete authorized keys than they have employees. Worse, authorized keys generally grant command-line shell access, which in itself is often considered privileged. We have found that in many organizations about 10% of the authorized keys grant root or administrator access. SSH keys never expire.” - Challenges in Managing SSH Keys – and a Call for Solutions by Tatu Ylonen (Inventor of SSH)

OPKSSH 将用户和管理员从管理长期有效的 SSH 密钥中解放出来，使 SSH 更安全、更便捷。“在许多组织中——即使是那些非常有安全意识的组织——过期的授权密钥数量往往是员工人数的数倍。更糟糕的是，授权密钥通常授予命令行 shell 访问权限，这本身通常被视为特权。我们发现，在许多组织中，约 10% 的授权密钥授予 root 或管理员访问权限。SSH 密钥永不过期。”——Tatu Ylonen（SSH 发明者）在《管理 SSH 密钥的挑战及解决方案呼吁》中写道。

In SSH, users generate a long-lived SSH public key and SSH private key. To enable a user to access a server, the user or the administrator of that server configures that server to trust that user’s public key. Users must protect the file containing their SSH private key. If the user loses this file, they are locked out. If they copy their SSH private key to multiple computers or back up the key, they increase the risk that the key will be compromised. When a private key is compromised or a user no longer needs access, the user or administrator must remove that public key from any servers it currently trusts. All of these problems create headaches for users and administrators.

在 SSH 中，用户会生成长期有效的 SSH 公钥和私钥。为了让用户访问服务器，用户或服务器管理员需要配置服务器以信任该用户的公钥。用户必须保护包含其 SSH 私钥的文件。如果用户丢失了此文件，他们将被锁定在系统之外。如果他们将 SSH 私钥复制到多台计算机或备份密钥，则会增加密钥被泄露的风险。当私钥泄露或用户不再需要访问权限时，用户或管理员必须从所有当前信任该密钥的服务器中删除该公钥。所有这些问题都给用户和管理员带来了麻烦。

OPKSSH overcomes these issues

OPKSSH 克服了这些问题

Improved security: OPKSSH replaces long-lived SSH keys with ephemeral SSH keys that are created on-demand by OPKSSH and expire when they are no longer needed. This reduces the risk a private key is compromised, and limits the time period where an attacker can use a compromised private key. By default, these OPKSSH public keys expire every 24 hours, but the expiration policy can be set in a configuration file.
Improved usability: Creating an SSH key is as easy as signing in to an OP. This means that a user can SSH from any computer with opkssh installed, even if they haven’t copied their SSH private key to that computer. To generate their SSH key, the user simply runs opkssh login, and they can use ssh as they typically do.
Improved visibility: OPKSSH moves SSH from authorization by public key to authorization by identity. If Alice wants to give Bob access to a server, she doesn’t need to ask for his public key, she can just add Bob’s email address bob@example.com to the OPKSSH authorized users file, and he can sign in. This makes tracking who has access much easier, since administrators can see the email addresses of the authorized users.
提高安全性： OPKSSH 用临时 SSH 密钥取代了长期有效的 SSH 密钥，这些密钥由 OPKSSH 按需创建，并在不再需要时过期。这降低了私钥被泄露的风险，并限制了攻击者使用被盗私钥的时间窗口。默认情况下，这些 OPKSSH 公钥每 24 小时过期一次，但过期策略可以在配置文件中设置。
提高易用性： 创建 SSH 密钥就像登录 OP 一样简单。这意味着用户可以从任何安装了 opkssh 的计算机进行 SSH 连接，即使他们没有将 SSH 私钥复制到该计算机上。要生成 SSH 密钥，用户只需运行 opkssh login，然后就可以像往常一样使用 ssh。
提高可见性： OPKSSH 将 SSH 从基于公钥的授权转变为基于身份的授权。如果 Alice 想让 Bob 访问服务器，她不需要索要他的公钥，只需将 Bob 的电子邮件地址 bob@example.com 添加到 OPKSSH 授权用户文件中，他就可以登录。这使得跟踪谁拥有访问权限变得容易得多，因为管理员可以直接看到授权用户的电子邮件地址。

OPKSSH does not require any code changes to the SSH server or client. The only change needed to SSH on the SSH server is to add two lines to the SSH config file. For convenience, we provide an installation script that does this automatically, as seen in this video.

OPKSSH 不需要对 SSH 服务器或客户端进行任何代码更改。在 SSH 服务器上，唯一需要做的更改是在 SSH 配置文件中添加两行代码。为了方便起见，我们提供了一个自动执行此操作的安装脚本，如本视频所示。

How it works

工作原理

Let’s look at an example of Alice (alice@example.com) using OPKSSH to SSH into a server: Alice runs opkssh login. This command automatically generates an ephemeral public key and private key for Alice. Then it runs the OpenPubkey protocol by opening a browser window and having Alice log in through their SSO provider, e.g., Google. If Alice SSOs successfully, OPKSSH will now have a PK Token.

让我们看一个 Alice (alice@example.com) 使用 OPKSSH 通过 SSH 连接到服务器的示例：Alice 运行 opkssh login。此命令会自动为 Alice 生成一个临时的公钥和私钥。然后，它通过打开浏览器窗口并让 Alice 通过其 SSO 提供商（例如 Google）登录来运行 OpenPubkey 协议。如果 Alice 成功完成 SSO 登录，OPKSSH 现在将获得一个 PK 令牌。