Security and latency
An issue with the above solutions using 802.1x, IPsec, and so forth is that they'll generally need root access, and 802.1x can be tricky to manage remotely. SSH is a great way to connect disparate systems (everything supports it by default), especially at the user level. For example, simply using public/private key pairs, you can easily configure a program on one system to connect to another system and run a program, connect to a socket, or use some other form of communication channel. The downside of SSH is key management, and rotation can be tricky unless, of course, you use OpenSSH certificates .
Traditional SSH relies simply on simple public/private key pairs. When you connect to a server, the public key is sent to you and you are asked whether you want to trust it. If this is the first time you're connecting to that server and you don't have some way to verify the key fingerprint, you really have no idea whether it is legitimate or not. In OpenSSH 5.4, support for a simple homegrown certificate protocol was added (for some reason, they wanted to avoid the complexity of X.509 certificates, and I tend to agree with them). Deployment and configuration are simple: You create a trusted signing key and then use it to sign host keys and user keys:
# ssh-keygen -f ssh_signing_key # ssh-keygen -h -s ssh_signing_key -I someid -V +365d -n hostname,hostname.example.org /etc/ssh/ssh_host_dsa_key.pub
You'll want the key signature to expire at some point (a year is good), and you'll need to specify the hostname and any aliases allowed for that host. The preceding command will drop the signed key into
/etc/ssh/ssh_host_dsa_key-cert.pub. To handle remote systems, you'll need to copy the key to your signing server, sign it, and then upload the signed copy to the original server and configure
sshd_config to use it:
Users will also need a copy of the public signing key so they can verify signatures made using the private signing key. The key itself needs to be in a text file with a
@cert-authority statement to let it know that it is the public part of a certificate-signing key pair:
@cert-authority * ssh-rsa [public key here]
You can then distribute that file manually and tell users to use the
-oUserKnownHostsFile command-line option; or, you can deploy it on all your systems in
/etc/ssh and use a
GlobalKnownHostsFile directive to point at the file so that all clients by default on that system trust the signing key. In future, new connections to any system with a signed public key will just work, so there will be no need to distribute the host keys manually and all that entails.
Kerberos and SSL Certificates
If you're not afraid of complexity, Kerberos and traditional SSL certificates can also work. However, you'll need to kerberize your services and clients or set everything up to handle SSL connections. Kerberos is especially well suited for large-scale deployments because it not only authenticates the client to the server but also the server to the client. Additionally, Kerberos uses several levels of tickets so that, ultimately, "service tickets" are used to connect to a service – such a ticket offers an attacker only minimal access at best.
Read full article as PDF:
New release comes with better semantic search and improvements to Kontact.
Annual code quality report shows FOSS is more secure at all project size levels.
The Raspberry Pi Foundation has announced an even smaller version of the tiny computer that will fit into a DIMM slot.
A new class of problems lets a malicious app pre-configure an invisible privilege update.
New Hack language adds static typing and other conveniences.
New crypto policy system will offer easier configuration and more uniform security.
Ubuntu founder denounces insecurity in proprietary, close-source software blobs.
Vulnerability affects many Linux web servers
The Bavarian capital shuns Microsoft, Google, and other alternatives to implement an open source groupware solution.
Phone vendor partnerships bring Mark Shuttleworth's dream of Ubuntu on a phone a step closer to reality.