feat(auth): add certificate-based authentication via SSH agent - #632
Conversation
Add support for authenticating with SSH certificates held by an SSH agent, complementing the existing key-based authentication flow. - Add FutureCertificate method variant for certificate auth - Add AgentIdentity enum to represent both keys and certificates - Implement sign_request_cert for certificate-based signing - Add authenticate_certificate_with for FutureCertificate auth flow - Add hash_alg support for RSA certificate signing - Comprehensive test coverage for new functionality Closes Eugeny#438
60c7463 to
6562551
Compare
|
Hi @Eugeny this should be ready for review. I validated it in our setup (an SSH bastion for our AI Agent sandbox where we want to control what's being passed through except we use cert based SSH auth). |
|
Hi @Eugeny - just wanted to poke in this PR |
|
This is also a blocker for https://github.com/chipsenkbeil/distant and https://github.com/chipsenkbeil/distant.nvim I switched over to russh from wezerm's ssh library powered by two separate C client libraries. Was trying it out to connect to a corporate VPN and hit this exact limitation. Would love to see this get reviewed when the author has time. In the meantime, I'm going to grab your branch @wi-adam and try to compile distant against it to see if that works for my corporate setup. [EDIT] Can confirm that @wi-adam branch works for me on my corporate setup, which is great. :) |
Servers requiring certificate-based auth (e.g. @cert-authority in known_hosts) reject bare public keys from the agent. OpenSSH handles this by loading the certificate from IdentityFile, matching it to the agent's key, and presenting the cert to the server while the agent signs the challenge. distant now does the same. Patch russh 0.57.1 with upstream PR #632 (Eugeny/russh#632) to add authenticate_certificate_with, sign_request_cert, and AgentIdentity. In distant-ssh, discover certificate files (-cert.pub) from identity files, parse IdentityAgent from ssh -G, and try cert+agent auth before plain agent auth — matching OpenSSH's order. Platform-specific agent connection mirrors the existing try_agent_auth pattern.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
Thank you! I've adjusted the API a bit @all-contributors add @wi-adam for code |
|
I've put up a pull request to add @wi-adam! 🎉 |
Adds @wi-adam as a contributor for code. This was requested by Eugeny [in this comment](#632 (comment)) [skip ci] --------- Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
| /// Ask the agent for a list of identities, including certificates. | ||
| pub async fn request_identities(&mut self) -> Result<Vec<AgentIdentity>, Error> { |
There was a problem hiding this comment.
This PR changed the return type of request_identities() (a public API), but it was released as a patch version 0.58.1, which breaks the semver - maybe it's worth yanking 0.58.1 and republishing it as v0.59?
5 participants
Summary
Add support for authenticating with SSH certificates held by an SSH agent, complementing the existing key-based authentication flow.
FutureCertificatemethod variant for certificate authAgentIdentityenum to represent both keys and certificatessign_request_certfor certificate-based signingauthenticate_certificate_withforFutureCertificateauth flowhash_algsupport for RSA certificate signingCloses #438