8000
  • Add support for OpenSSH certificates by Rob-Hague · Pull Request #1498 · sshnet/SSH.NET · GitHub
    [go: up one dir, main page]
    Skip to content

    Add support for OpenSSH certificates#1498

    Merged
    Rob-Hague merged 4 commits intosshnet:developfrom
    Rob-Hague:certificates
    Oct 19, 2024
    Merged

    Add support for OpenSSH certificates#1498
    Rob-Hague merged 4 commits intosshnet:developfrom
    Rob-Hague:certificates

    Conversation

    @Rob-Hague
    Copy link
    Collaborator
    @Rob-Hague Rob-Hague commented Sep 19, 2024

    Here's how to use it:

    When authenticating i.e. when you have a certificate for your key which is signed by a certificate authority that the server trusts:

    using (var privateKeyFile = new PrivateKeyFile("path/to/my/key", passPhrase: null, "path/to/my/certificate.pub"))
using (var client = new SshClient("sftp.foo.com", "guest", privateKeyFile))
{
    client.Connect();
}

    When validating the host i.e. when expecting the server to present a certificate signed by a trusted certificate authority:

    string expectedCAFingerPrint = "tF3DRTUXtYFZ5Yz0SBOrEbixHaCifHmNVK6FtptXZVM";

using (var client = new SshClient("sftp.foo.com", "guest", "pwd"))
{
    client.HostKeyReceived += (sender, e) =>
    {
        e.CanTrust = e.Certificate?.CertificateAuthorityKeyFingerPrint == expectedCAFingerPrint;
    };
    client.Connect();
}

    closes #479
    closes #963
    closes #1196

    of existing PRs:
    closes #595
    closes #682

    @Rob-Hague @MicrovisionCLG
    Add support for OpenSSH certificates
    958e6b8 
    Co-authored-by: cedricMicrovision <cedric.legoff@microvision.fr>
    Rob-Hague
    Rob-Hague commented Sep 19, 2024
    View reviewed changes
    src/Renci.SshNet/ConnectionInfo.cs
    Comment on lines +391 to +392
    var hostAlgs = new Dictionary<string, Func<byte[], KeyHostAlgorithm>>();
    hostAlgs.Add("ssh-ed25519-cert-v01@openssh.com", data => { var cert = new Certificate(data); return new CertificateHostAlgorithm("ssh-ed25519-cert-v01@openssh.com", cert, hostAlgs); });
    Copy link
    Collaborator Author
    @Rob-Hague Rob-Hague Sep 19, 2024

    Choose a reason for hiding this comment

    The reason will be displayed to describe this comment to others. Learn more.

    In order to make the host validation example work, the certificate algorithms should be listed first (so that the server knows to send its certificate). Doing this comes with a risk in case there is an unknown bug in the new code. I think the test coverage is good enough, but we could list the new algorithms last to avoid this risk.

    @Rob-Hague Rob-Hague mentioned this pull request Sep 21, 2024
    Merged
    drieseng
    drieseng approved these changes Oct 15, 2024
    View reviewed changes
    Copy link
    Member
    @drieseng drieseng left a comment

    Choose a reason for hiding this comment

    The reason will be displayed to describe this comment to others. Learn more.

    Nice work!

    It would be great to have unit tests for Certificate and the new (or newly implemented) properties of CertificateHostAlgorithm.

    I'm not blocking this PR for this though.

    Thanks!

    @Rob-Hague
    Copy link
    Collaborator Author
    Rob-Hague commented Oct 19, 2024

    Thanks! I added some more tests on the public properties. Those for Certificate go through PrivateKeyFile rather than directly through the constructor but that seems reasonable enough

    @Rob-Hague Rob-Hague merged commit 3e12c96 into sshnet:develop Oct 19, 2024
    @Rob-Hague Rob-Hague deleted the certificates branch October 19, 2024 12:36
    @jeevanbalanmanoj
    Copy link
    jeevanbalanmanoj commented Nov 7, 2024

    Fantastic to see this. Is this available in the main branch? When will it be usable?

    @Rob-Hague
    Copy link
    Collaborator Author
    Rob-Hague commented Nov 7, 2024

    We will make a release "soon", in the meantime, you can try it out from the CI feed https://ci.appveyor.com/nuget/ssh-net e.g. version 2024.2.0-prerelease.1 should have it

    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Reviewers

    @drieseng drieseng drieseng approved these changes

    @WojciechNagorski WojciechNagorski Awaiting requested review from WojciechNagorski WojciechNagorski is a code owner

    Assignees

    No one assigned

    Labels

    None yet

    Projects

    None yet

    Milestone

    No milestone

    Development

    Successfully merging this pull request may close these issues.

    Issue with ED2559 ssh connection User Certificate support Support for ssh-rsa-cert-v01 certificates

    3 participants

    @Rob-Hague @jeevanbalanmanoj @drieseng
    0