Cloudflare has open-sourced OPKSSH, a tool that integrates single sign-on (SSO) with SSH, eliminating the need for managing individual SSH keys. OPKSSH achieves this by leveraging OpenID Connect (OIDC) and issuing short-lived SSH certificates signed by a central Certificate Authority (CA). This allows users to authenticate with their existing SSO credentials, simplifying access management and improving security by eliminating static, long-lived SSH keys. The project aims to standardize SSH certificate issuance and validation through a simple, open protocol, contributing to a more secure and user-friendly SSH experience.
A critical vulnerability was discovered impacting multiple SAML single sign-on (SSO) libraries across various programming languages. This vulnerability stemmed from inconsistencies in how different XML parsers interpret and handle XML signatures within SAML assertions. Attackers could exploit these "parser differentials" by crafting malicious SAML responses where the signature appeared valid to the service provider's parser but actually signed different data than what the identity provider intended. This allowed attackers to potentially impersonate any user, gaining unauthorized access to systems protected by vulnerable SAML implementations. The blog post details the vulnerability's root cause, demonstrates exploitation scenarios, and lists the affected libraries and their patched versions.
Hacker News commenters discuss the complexity of SAML and the difficulty of ensuring consistent parsing across different implementations. Several point out that this vulnerability highlights the inherent fragility of relying on complex, XML-based standards like SAML, especially when multiple identity providers and service providers are involved. Some suggest that simpler authentication methods would be less susceptible to such parsing discrepancies. The discussion also touches on the importance of security audits and thorough testing, particularly for critical systems relying on SSO. A few commenters expressed surprise that such a vulnerability could exist, highlighting the subtle nature of the exploit. The overall sentiment reflects a concern about the complexity and potential security risks associated with SAML implementations.
Summary of Comments ( 88 )
https://news.ycombinator.com/item?id=43470906
HN commenters generally express interest in OpenPubkey but also significant skepticism and concerns. Several raise security implications around trusting a third party for SSH access and the potential for vendor lock-in. Some question the actual benefits over existing solutions like SSH certificates, agent forwarding, or using configuration management tools. Others see potential value in simplifying SSH key management, particularly for less technical users or in specific scenarios like ephemeral cloud instances. There's discussion around key discovery, revocation speed, and the complexities of supporting different identity providers. The closed-source nature of the server-side component is a common concern, limiting self-hosting options and requiring trust in Cloudflare. Several users also mention existing open-source projects with similar goals and question the need for another solution.
The Hacker News post titled "Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH" has generated a number of comments discussing the merits and drawbacks of the proposed system. Several users express enthusiasm for the potential simplification of SSH key management, particularly for larger organizations. The ability to manage SSH access through existing identity providers is seen as a significant advantage, streamlining onboarding and offboarding processes.
Some commenters raise concerns about security implications. Centralizing authentication control through an identity provider introduces a single point of failure and potentially expands the blast radius of a compromise. The reliance on a third-party service for SSH access is viewed with skepticism by some, who prefer the traditional decentralized model of SSH key management. There's also discussion about the potential for vendor lock-in and the complexities that might arise if the identity provider experiences an outage.
A few comments delve into the technical details of the implementation. Questions are raised about the specific protocols used, the level of integration with existing SSH infrastructure, and the potential performance impact of the additional authentication steps. Some users express interest in seeing comparisons with other SSH certificate authority solutions.
The discussion also touches on the practicality of the approach for different use cases. While the benefits are apparent for corporate environments, some commenters question the suitability for individual users or smaller teams who might find the added complexity outweighs the advantages.
Several users offer alternative solutions or suggest improvements to the proposed system, such as incorporating hardware security keys or supporting different authentication methods. The overall sentiment appears to be cautious optimism, with many acknowledging the potential benefits while also highlighting the need for careful consideration of the security and implementation challenges.