Date: Fri, 17 Nov 2006 14:29:56 +0100 From: Daniel Lang <dl@leo.org> To: "Wolfgang S. Rupprecht" <wolfgang+gnus200611@dailyplanet.dontspam.wsrcc.com> Cc: freebsd-current@freebsd.org, openssh-unix-dev@mindrot.org, tech@openbsd.org Subject: Re: OpenSSH Certkey (PKI) Message-ID: <20061117132956.GB26343@tortuga.leo.org> In-Reply-To: <87ac2rjqaf.fsf@arbol.wsrcc.com> References: <20061115142820.GB14649@insomnia.benzedrine.cx> <87odr8i53w.fsf@arbol.wsrcc.com> <20061116135627.GA26343@tortuga.leo.org> <87ac2rjqaf.fsf@arbol.wsrcc.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi, Wolfgang S. Rupprecht wrote on Thu, Nov 16, 2006 at 08:43:20AM -0800: [..] > Oops. I quoted the wrong section. I had meant to quote the section > about the user_certificates. This is what I meant to cite: > > +A user certificate is an authorization made by the CA that the > +holder of a specific private key may login to the server as a > +specific user, without the need of an authorized_keys file being > +present. The CA gains the power to grant individual users access > +to the server, and users do no longer need to maintain > +authorized_keys files of their own. > > I don't see a problem with the host certificates methodology. (In > fact I'd love to see the known_hosts files fade away as more hosts > transition to using host certificates.) Ok, I see. A user certificate just means that the user is authenticated, so I agree that the difference between authentication and authorisation can be mixed up here and becomes blurred. In fact, it would mean, that you could abandon the authorized_keys file, but you would still need an "authorized_users" file, that would need to contain the DN (or a similar identifier) of the user that matches the certificate. So not a lot is saved, but things may become less transparent.... Cheers, Daniel
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20061117132956.GB26343>