TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

SSH Key Management with DNSSEC

1 post · Jan 2016 – Mar 2025

What this trail covers

Cloudflare's platform has evolved to enable innovative security solutions by leveraging DNSSEC for SSH key management. This allows for secure, centralized storage and retrieval of public keys via DNS TXT records, simplifying key distribution and revocation for administrators. This capability enhances the security posture of SSH deployments by integrating with DNSSEC's cryptographic validation, ensuring the integrity and authenticity of public keys used for authentication. This has now been extended to integrate with OpenID Connect (OIDC) via the OpenPubkey protocol, allowing for ephemeral SSH keys to be generated on-demand and authenticated using SSO tokens, eliminating the need for long-lived SSH keys and simplifying access management.

All Cloudflare trails
  1. Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSHThis post introduces the open-sourcing of OPKSSH (OpenPubkey SSH), which integrates OpenID Connect (OIDC) with SSH for single sign-on (SSO) authentication. It replaces long-lived SSH keys with ephemeral keys generated on-demand and authenticated via PK Tokens, which are signed by an Identity Provider (IdP) and commit to the user's public key. OPKSSH packages these PK Tokens into SSH certificate extensions to be transmitted within the SSH protocol without modifying SSH clients or servers. The SSH server uses an `AuthorizedKeysCommand` to invoke the OpenPubkey verifier, which validates the PK Token's expiration, signature, and matches the public key within the token to the SSH public key, thereby authorizing access based on the user's email address. This significantly improves SSH security and usability by removing the burden of managing long-lived SSH keys.
  2. Flexible, secure SSH with DNSSECThis post introduces a novel method for managing SSH public keys by storing them in DNSSEC-signed TXT records. It details the requirements for OpenSSH servers (v6.2+), DNSSEC validation, and key length limitations. A shell script (`pubkeygrab.sh`) is provided to retrieve and validate these keys, which can then be configured in `sshd_config` via `AuthorizedKeysCommand`. The post highlights the security benefits of using DNSSEC for key distribution and revocation, turning Cloudflare into a PKI for SSH.