<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" id="owaParaStyle">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">https://review.openstack.org/#/c/222293/<br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF766623" style="direction: ltr;"><font face="Tahoma" color="#000000" size="2"><b>From:</b> Giuseppe de Candia [giuseppe.decandia@gmail.com]<br>
<b>Sent:</b> Friday, September 29, 2017 1:05 PM<br>
<b>To:</b> OpenStack Development Mailing List (not for usage questions)<br>
<b>Subject:</b> Re: [openstack-dev] Supporting SSH host certificates<br>
</font><br>
</div>
<div></div>
<div>
<div dir="ltr">Ihar, thanks for pointing that out - I'll definitely take a close look.
<div><br>
</div>
<div>Jon, I'm not very familiar with Barbican, but I did assume the full implementation would use Barbican to store private keys. However, in terms of actually getting a private key (or SSH host cert) into a VM instance, Barbican doesn't help. The instance
needs permission to access secrets stored in Barbican. The main question of my e-mail is: how do you inject a credential in an automated but secure way? I'd love to hear ideas - in the meantime I'll study Ihar's link.</div>
<div><br>
</div>
<div>thanks,</div>
<div>Pino</div>
<div><br>
</div>
<div><br>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Sep 29, 2017 at 2:49 PM, Ihar Hrachyshka <span dir="ltr">
<<a href="mailto:ihrachys@redhat.com" target="_blank">ihrachys@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
What you describe (at least the use case) seems to resemble<br>
<a href="https://review.openstack.org/#/c/456394/" rel="noreferrer" target="_blank">https://review.openstack.org/#<wbr>/c/456394/</a> This work never moved<br>
anywhere since the spec was posted though. You may want to revive the<br>
discussion in scope of the spec.<br>
<span class="HOEnZb"><font color="#888888"><br>
Ihar<br>
</font></span>
<div class="HOEnZb">
<div class="h5"><br>
On Fri, Sep 29, 2017 at 12:21 PM, Giuseppe de Candia<br>
<<a href="mailto:giuseppe.decandia@gmail.com" target="_blank">giuseppe.decandia@gmail.com</a>> wrote:<br>
> Hi Folks,<br>
><br>
><br>
><br>
> My intent in this e-mail is to solicit advice for how to inject SSH host<br>
> certificates into VM instances, with minimal or no burden on users.<br>
><br>
><br>
><br>
> Background (skip if you're already familiar with SSH certificates): without<br>
> host certificates, when clients ssh to a host for the first time (or after<br>
> the host has been re-installed), they have to hope that there's no man in<br>
> the middle and that the public key being presented actually belongs to the<br>
> host they're trying to reach. The host's public key is stored in the<br>
> client's known_hosts file. SSH host certicates eliminate the possibility of<br>
> Man-in-the-Middle attack: a Certificate Authority public key is distributed<br>
> to clients (and written to their known_hosts file with a special syntax and<br>
> options); the host public key is signed by the CA, generating an SSH<br>
> certificate that contains the hostname and validity period (among other<br>
> things). When negotiating the ssh connection, the host presents its SSH host<br>
> certificate and the client verifies that it was signed by the CA.<br>
><br>
><br>
><br>
> How to support SSH host certificates in OpenStack?<br>
><br>
><br>
><br>
> First, let's consider doing it by hand, instance by instance. The only<br>
> solution I can think of is to VNC to the instance, copy the public key to my<br>
> CA server, sign it, and then write the certificate back into the host (again<br>
> via VNC). I cannot ssh without risking a MITM attack. What about using Nova<br>
> user-data? User-data is exposed via the metadata service. Metadata is<br>
> queried via http (reply transmitted in the clear, susceptible to snooping),<br>
> and any compute node can query for any instance's meta-data/user-data.<br>
><br>
><br>
><br>
> At this point I have to admit I'm ignorant of details of cloud-init. I know<br>
> cloud-init allows specifying SSH private keys (both for users and for SSH<br>
> service). I have not yet studied how such information is securely injected<br>
> into an instance. I assume it should only be made available via ConfigDrive<br>
> rather than metadata-service (again, that service transmits in the clear).<br>
><br>
><br>
><br>
> What about providing SSH host certificates as a service in OpenStack? Let's<br>
> keep out of scope issues around choosing and storing the CA keys, but the CA<br>
> key is per project. What design supports setting up the SSH host certificate<br>
> automatically for every VM instance?<br>
><br>
><br>
><br>
> I have looked at Vendor Data and I don't see a way to use that, mainly<br>
> because 1) it doesn't take parameters, so you can't pass the public key out;<br>
> and 2) it's queried over http, not https.<br>
><br>
><br>
><br>
> Just as a feasibility argument, one solution would be to modify Nova compute<br>
> instance boot code. Nova compute can securely query a CA service asking for<br>
> a triplet (private key, public key, SSH certificate) for the specific<br>
> hostname. It can then inject the triplet using ConfigDrive. I believe this<br>
> securely gets the private key into the instance.<br>
><br>
><br>
><br>
> I cannot figure out how to get the equivalent functionality without<br>
> modifying Nova compute and the boot process. Every solution I can think of<br>
> risks either exposing the private key or vulnerability to a MITM attack<br>
> during the signing process.<br>
><br>
><br>
><br>
> Your help is appreciated.<br>
><br>
><br>
><br>
> --Pino<br>
><br>
><br>
</div>
</div>
<div class="HOEnZb">
<div class="h5">> ______________________________<wbr>______________________________<wbr>______________<br>
> OpenStack Development Mailing List (not for usage questions)<br>
> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">
OpenStack-dev-request@lists.<wbr>openstack.org?subject:<wbr>unsubscribe</a><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">
http://lists.openstack.org/<wbr>cgi-bin/mailman/listinfo/<wbr>openstack-dev</a><br>
><br>
<br>
______________________________<wbr>______________________________<wbr>______________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">
OpenStack-dev-request@lists.<wbr>openstack.org?subject:<wbr>unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/<wbr>cgi-bin/mailman/listinfo/<wbr>openstack-dev</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</body>
</html>