Zero Trust SSH
summary
OpenSSH certificates replace per-user keys with a single CA key and short expiries, implemented here with short-lived SSH certificates obtained via an OAuth2 browser flow, OpenID Connect and an agent that signs keys by calling an AWS Lambda (optionally backed by KMS async signing). The stack uses a shrimp agent implementing the SSH agent protocol, Lambda certificate signing, host certs, and PAM sudo checks; a working shrimp+shrimp-lambda prototype and repos exist and are demoed successfully.
AI-written summary · about
chapters (16)
- 0:00Intro
- 5:20Certificate Authority Private Key
- 7:00SSH Keygen Config
- 10:15Onboarding Users
- 16:55Signing Certs
- 19:33Shrimp
- 25:57Certificates
- 26:17User Provision
- 26:52SSH as Jeremy
- 28:02Backup Keys
- 29:04Private Keys
- 29:34MultiTrust
- 30:17Bonus
- 32:39Questions
- 36:52Identity Agent
- 37:32Revocation List
related talks
28mManaging SSH Access without Managing SSH Keys
41mA better way to SSH: Introducing SSH certificates
11mIf You’re Not Using SSH Certificates You’re Doing SSH Wrong
23mAutomation with Scalable & Secure SSH
32mKeys or Certs for SSH Access? Why should I care?
44mEngineering Secure SSH Access for Engineers- 44mEngineering Secure SSH Access for Engineers
29mSSH Certificates: a way to scale SSH access