OpenSSH and X.509 Certificate Support

sankalp_karpe sankalp_karpe at persistent.co.in
Thu Feb 21 23:43:10 EST 2008


Hi Roumen,

I could successfully add X.509 Certificate support to OpenSSH.
Earlier, the error I was facing was with "ssh-add": unable to open a 
connection to your authentication agent.

I found some help on 
"http://funkaoshi.com/blog/could-not-open-a-connection-to-your-authentication-agent" 
with which I could resolve the same.

Here is the entire step by step procedure that I followed to add X.509 
certificate support to OpenSSH (implemented for "root" login on both the 
machines)
Could you please confirm and suggest changes required if any.

(1) Download OpenSSH-4.7p1 from: 
http://openbsd.md5.com.ar/pub/OpenBSD/OpenSSH/portable/

(2) Download x.509 patch for this version from: 
http://roumenpetrov.info/openssh/download.html

(3) Patch the OpenSSH source with this patch and install it on both 
Server and Client machines (./configure --prefix=/opt/ssh && make && 
make install)

Now on the Server machine perform the following:

(4) Gnereate the ca, server, client certificates using the following 
procedure:

mkdir certs && cd certs

CA certificate generation
openssl genrsa -out ca-key.pem 2048
openssl req -new -x509 -nodes -days 50000 -key ca-key.pem -out cacert.pem
Answer questions with appropriate data.
Openssl commands generate a 2048 bit key and a certificate valid for a 
fifty thousand day period.

Server certificate generation
openssl req -newkey rsa:2048 -days 50000 -nodes -keyout server-key.pem 
-out server-req.pem
openssl x509 -req -in server-req.pem -days 50000 -CA cacert.pem -CAkey 
ca-key.pem -set_serial 01 -out server.pem

Client certificate generation
openssl req -newkey rsa:2048 -days 50000 -nodes -keyout client-key.pem 
-out client-req.pem
openssl x509 -req -in client-req.pem -days 50000 -CA cacert.pem -CAkey 
ca-key.pem -set_serial 01 -out client.pem

(5) Copy the generated certificates under /opt/ssh/etc/ca

(6) Build server host id using (cd to /opt/ssh/etc):

cat ca/server-key.pem > ssh_host_key_cert
cat ca/server.pem >> ssh_host_key_cert
chmod 0600 ssh_host_key_cert
../bin/ssh-keygen -y > ssh_host_key_cert.pub
// entering 'ssh_host_key_cert' as key when prompted

(7) Add the following directives in /opt/ssh/etc/sshd_config

HostKey /opt/ssh/etc/ssh_host_key_cert
CACertificateFile /opt/ssh/etc/ca/crt/cacert.pem
Port 22
X509KeyAlgorithm x509v3-sign-rsa,rsa-md5
X509KeyAlgorithm x509v3-sign-rsa,rsa-sha1
AllowedCertPurpose sslclient
PasswordAuthentication no


Now on client machine perform the following:

(8) under /root/.ssh/, copy client.pem, client-key.pem and cacert.pem 
from the Server

Build identity,

As root, execute the following commands:

cat ~/.ssh/client-key.pem > ~/.ssh/id_rsa
cat ~/.ssh/client.pem >> ~/.ssh/id_rsa
chmod 0600 ~/.ssh/id_rsa
/opt/ssh/bin/ssh-keygen -y > ~/.ssh/id_rsa.pub
// entering ~/.ssh/id_rsa as key when prompted


(9) Introduce following changes in /opt/ssh/etc/ssh_config:

Port 22
IdentityFile ~/.ssh/id_rsa
UserCACertificateFile ~/.ssh/cacert.pem

(10) Copy /root/.ssh/id_rsa.pub from the Client to the Server (/root/) 
and append to authorized keys file.

cat /root/id_rsa.pub >> ~/.ssh/authorized_keys

(11) Finally launch sshd on Server with either of the following commands:

/opt/ssh/sbin/sshd -f /opt/ssh/etc/sshd_config -d -d -d

- to view the debug messages

OR

/opt/ssh/sbin/sshd -f /opt/ssh/etc/sshd_config

- to run the daemon in background

(11) On the Client execute the following commands:
/opt/ssh/bin/ssh-agent
eval `/opt/ssh/bin/ssh-add`
/opt/ssh/bin/ssh-add

(12) ssh to the Server machine from the Client,

Here is the output that we see:

[root at localhost ~]# /opt/ssh/bin/ssh root at 10.244.8.83
The authenticity of host '10.244.8.83 (10.244.8.83)' can't be established.
RSA+cert key fingerprint is 6d:15:9f:26:fe:5c:16:4f:5e:80:12:80:54:cb:49:56.
Distinguished name is 
'C=IN,ST=GOA,L=GOA,O=PSL,OU=VLSI,CN=10.244.8.83,emailAddre                                                                             
ss=joviserver at jovi.com'.
Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added '10.244.8.83' (RSA+cert) to the list of known 
hosts.
Last login: Mon Jan 21 21:09:28 2008 from 10.244.8.167
debug1: permanently_set_uid: 0/0
Environment:
  USER=root
  LOGNAME=root
  HOME=/root
  PATH=/usr/bin:/bin:/usr/sbin:/sbin:/opt/ssh/bin
  MAIL=/var/mail/root
  SHELL=/bin/bash
  SSH_CLIENT=10.244.8.167 41513 22
  SSH_CONNECTION=10.244.8.167 41513 10.244.8.83 22
  SSH_TTY=/dev/pts/2
  TERM=xterm
debug3: channel 0: close_fds r -1 w -1 e -1 c -1
[root at localhost ~]#


*ISSUES faced:*

The following commands did not execute and gave errors:

(a) /opt/ssh/bin/ssh -vvv -f /opt/ssh/etc/ssh_config -d -d -d 
myuser at myserver

OpenSSH_4.7p1, OpenSSL 0.9.8b 04 May 2006
ssh: illegal option -- d
usage: ssh [-1246AaCfgKkMNnqsTtVvXxY] [-b bind_address] [-c cipher_spec]
           [-D [bind_address:]port] [-e escape_char] [-F configfile]
           [-i identity_file] [-L [bind_address:]port:host:hostport]
           [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]
           [-R [bind_address:]port:host:hostport] [-S ctl_path]
           [-w local_tun[:remote_tun]] [user@]hostname [command]


(b) /opt/ssh/bin/ssh -vvv -f /opt/ssh/etc/ssh_config myuser at myserver

OpenSSH_4.7p1, OpenSSL 0.9.8b 04 May 2006
debug1: Reading configuration data /opt/ssh//etc/ssh_config
debug2: hash dir '/root/.ssh/crt' added to x509 store
debug2: file '/root/.ssh/ca-cert.pem' added to x509 store
debug2: hash dir '/root/.ssh/crl' added to x509 revocation store
debug2: hash dir '/opt/ssh//etc/ca/crt' added to x509 store
debug2: hash dir '/opt/ssh//etc/ca/crl' added to x509 revocation store
debug1: ssh_set_validator: ignore responder url
debug2: ssh_connect: needpriv 0
ssh: /opt/ssh/etc/ssh_config: Name or service not known


Thanks,
Sankalp



Roumen Petrov wrote:

>sankalp_karpe wrote:
>  
>
>>Hi,
>>
>>I need to add X.509 Certificate support to OpenSSH.
>>
>>I came across the following post on the openssh-unix-dev mailing list 
>>that is very useful:
>>http://marc.info/?l=openssh-unix-dev&m=120298135706959&w=2 
>><http://marc.info/?l=openssh-unix-dev&m=120298135706959&w=2>
>>
>>And also, http://marc.info/?l=openssh-unix-dev&m=104395024824680&w=2 
>><http://marc.info/?l=openssh-unix-dev&m=104395024824680&w=2> that 
>>provides the required patches to dowload for OpenSSH to support X.509 
>>certificates.
>>
>>I am using FC6 and have followed the steps mentioned in the above post, 
>>but I am unable to successfully complete the task :(
>>Is there any step-by-step procedure that I could refer to to achieve the 
>>same?
>>
>>Thanks and Regards,
>>Sankalp
>>  
>>    
>>
>Please, could you clarify "successfully complete the task".
>
>RedHat OpenSSH sources are heavy patched and chance patch to be applied 
>without problem is zero.
>
>References:
>- README.x509v3 for specified version 
>http://roumenpetrov.info/openssh/download.html
>- http://roumenpetrov.info/domino_CA/
>
>Roumen
>
>  
>



More information about the openssh-unix-dev mailing list