14

I'm trying to install the development tools for a small team, and I can't get the authentication right.

Since we are a distributed team, the server is on the internet. And I'd like to have SSO+zero client configuration.

So basically git over https+webdav is impractical, because the git client can only use basic auth but doesn't save the password and some IDE plugin don't even forward the password question in their UI.

I have to use git over ssh then. I installed gitosis and it basically works with asymmetric keys, ok. I'll have to ask each dev to install their key, I can do that, forget zero configuration.

Then I want the developers to access the web tools (wiki, tickets, etc.) that are on https, but this time I have to give them either a login/password or another private key just because the formats aren't compatible between SSH and SSL and the place to store it on the OS is not the same. Now, I have to forget the SSO?

Am I mistaken?

Improve this question

3 Answers 3

Reset to default
13

TL;DR summary: If you have a SSL/X.509 certificate+key, just give the private key file to ssh. Or, if you already have a SSH key in id_rsa, just use it with OpenSSL when signing a CSR. That's all.

Let's assume you have an user's SSL certificate in joeuser.pem and its private key in joeuser.key.

Since X.509 uses standard RSA keys, and so does SSH, you should be able to just tell your SSH client to use joeuser.key -- the only requirement is that it be in an understandable format.

Look at the insides of joeuser.key and check if it looks kinda like this:

-----BEGIN RSA PRIVATE KEY-----
MGECAQACEQCxQaFwijLYlXTOlwqnSW9PAgMBAAECEETwgqpzhX0IVhUa0OK0tgkC
CQDXPo7HDY3axQIJANLRsrFxClMDAghaZp7GwU2T1QIIMlVMo57Ihz8CCFSoKo3F
2L/2
-----END RSA PRIVATE KEY-----

In OpenSSL, this format is called "PEM" (as in -outform pem) and is used by default. The same format is used by OpenSSH, and you can use ssh -i joeuser.key to connect.

You can extract the public key in OpenSSH id_rsa.pub format (for putting into authorized_keys) with:

ssh-keygen -y -f joeuser.key > joeuser-ssh.pub

(The same public key in PEM format can be extracted with openssl rsa -pubout, but it will be of little use.)

If you have a DSA key, it should work exactly the same like RSA.

Improve this answer
9
  • hello, thanks, but I know I can convert one key format to another for each developer, but my problem is avoiding as much configuration on their part as possible. As far as I remember (I confess I didn't check recently) adding a 509 certificate for all client browser is not trivial.
    – nraynaud
    Feb 19, 2010 at 0:07
  • 4
    nraynaud: They are developers. If they cannot install a X.509 cert to their favourite browser (at least by following TFM), it's already scary.
    – u1686_grawity
    Feb 19, 2010 at 17:29
  • ...anyway. For NSS-based browsers (Firefox, Mozilla, Epiphany) there's a set of command-line tools to modify cert.db. For Windows, certificates can be installed using certutil or (I think) through AD group policy. SSH requires no configuration at all, just ssh-keygen -y -f and dump both files to user's homedir.
    – u1686_grawity
    Feb 19, 2010 at 17:29
  • 4
    they are not developers, they freshmen out of school and interns. I'm just hammering them with git, web security, javascript, security and clean code. I just want to limit this kind of non development centric stuff. (moreover, I hate people who impose me this kind of silly things, so I just to avoid imposing that on others)
    – nraynaud
    Feb 21, 2010 at 0:32
  • 2
    While this will work, I'll advise against it. You're using the same keys, but in different ways, different formats. When users generate new X.509 certs, they'll be using different keys for SSH and HTTPS anyway. It would make sense if OpenSSH would support full X.509 PKI (the way OpenVPN does, where you can use scripts to link certs to LDAP and check if a user is in appropriate group).
    – Hubert Kario
    Dec 14, 2012 at 0:19
5

OpenSSH has experimental support for x509 certificates here:

http://roumenpetrov.info/openssh

You could issue a single x509 certificate per user and use them for both.

instead of putting the user pubkey in their authorized_keys, you can specify the allowed DNs of the user certificates; and you must configure the webserver/web application so that the DN is translated to a username.

Improve this answer
3
  • Thanks a lot, but installation is even worse that configuration I think.
    – nraynaud
    Feb 21, 2010 at 0:33
  • You mean installing the patched version of openssh ? it may be already shipped by your distribution (I know that at least Gentoo does). There is no point in using the same RSA key for both applications but with a different format - you still have to set up the ssh public key of each user by hand. OTOH, with x.509 keys, you could keep your CA separate, and adding new users to SSH or HTTPS can be done without knowledge of their public key, you only need to pick a consistent DN policy...
    – b0fh
    Feb 21, 2010 at 15:11
  • 2
    FYI, this functionality is now in the mainline version of OpenSSH.
    – Zoredache
    Dec 28, 2012 at 20:34
1

You're pretty much out of luck - SSH keys and SSL certificates are different animals and as far as I know they aren't interchangeable.

Your best bet is probably to configure single sign-on / shared password store / whatever for your web tools & leave git/gitosis as an authentication island.

Improve this answer

You must log in to answer this question.