sshlogin: securely authenticating to remote Linux systems via ...
summary
Proposal to reuse existing SSH keys for text-only emergency logins by turning SSH keypairs into an ECDH-based challenge that produces a short base64 OTP (demo uses 8 bytes → ~12 chars). Implementation is a Linux PAM module that verifies the derived secret, supports hardware PIV/YubiKey with PIN-protected keys, and ships a client helper that auto-extracts the challenge and injects the response. Prototype runs in demos and is slated for open source release.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:08Remote access challenges
- 3:09Emergency access limitations
- 7:08Problems with passwords
- 11:31OTP alternatives
- 19:01Public key-based authentication
- 27:29Implementing with Linux PAM
- 35:00Practical sshlogin demo
- 39:29Hardware keys and 2FA
- 43:40Improving user experience
- 48:10Conclusion and Q&A
related talks
44mEngineering Secure SSH Access for Engineers
15mUp your SSH security game
40m Authentication is Broken. Can We Try Fix It?- 44mEngineering Secure SSH Access for Engineers
32mKeys or Certs for SSH Access? Why should I care?
12mDude where is my password?
28mManaging SSH Access without Managing SSH Keys
59mPasswordless Future: Using WebAuthn And Passkeys In Practice