sshlogin: securely authenticating to remote Linux systems via a serial or a text-based interface - Ignat Korchagin

This talk was recorded at NDC Security in Oslo, Norway. #ndcsecurity  #ndcconferences  #security  #developer   #softwaredeveloper    

Attend the next NDC conference near you: 
https://ndcconferences.com
https://ndc-security.com/

Subscribe to our YouTube channel and learn every day:  @NDC 

Follow our Social Media!

https://www.facebook.com/ndcconferences
https://twitter.com/NDC_Conferences
https://www.instagram.com/ndc_conferences

#cloudsecurity #devops 

Securely authenticating to remote systems seems like a solved problem: we have SSH, which is a secure cryptographic system with public key authentication, strong encryption and many addons and extensions that even allow hardware-based security such as smart cards and YubiKeys.

However, all this falls apart if we need to access a system with no network connection. These could range from low-end small IoT devices to even high performance servers with a broken or a misconfigured network card. Such systems usually only provide access via a serial port (or a similar text based interface) or emulate a browser-based KVM (keyboard-video-mouse). So to authenticate one needs to actually type something in and most text based authentication is still relying on plain old passwords.

Password-based authentication has some security challenges: passwords may leak, may be cracked and need to be rotated periodically. Wouldn’t it be great to be able to just use the same secure cryptographic authentication as in SSH for text-based logins? This presentation proposes a protocol and an implementation on how to reuse existing SSH keys for text based authentication. We will also explore how to further enhance the security of the solution by using hardware-backed SSH credentials.

NDC Conferences

A Cloudflare engineer presents a solution for secure authentication over text-based/serial interfaces used in emergency out-of-band server access. The talk covers why passwords and standard OTPs fall short for this use case, then proposes a public-key-based OTP scheme using ECDH with existing SSH keys. The server presents a one-time public key challenge; the client computes a shared secret using their SSH private key and returns a short (8-byte) base64-encoded response. Implementation is done via a custom Linux PAM module that integrates with the login program, supporting both software SSH keys and hardware PIV keys (YubiKey) for full 2FA. A 'Clippy' wrapper tool automates the challenge-response flow to improve UX for operations teams.

sshlogin: securely authenticating to remote Linux systems via ... - Ignat Korchagin