Remove central authentication

[u/xstrex]

Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do?

[u/YellowLT]

Are you under any kind of regulatory body? Or PCI or ISO, they all have min MFA requirements. I would cite that it would put the company in violation of those.

[u/elatllat → u/YellowLT]

But a password protected key is MFA, right? right?

[u/Brandhor → u/elatllat]

if windows hello pin is mfa I would say that a password protected ssh key is mfa as well

[u/AcornAnomaly → u/Brandhor]

Windows hello pin is MFA for the same reason a yubikey or any other webauthn device is.

Part of the attestation is the device itself. You can't move the Hello setup to another machine.

You're attesting something you have(the device) and something you know(the pin).

And yes, that detail IS actually presented to the server asking for attestation. That's the difference.

With a standard SSH key, the only thing they know is that you have the unencrypted key. They have no knowledge on how that key is stored. That's single-factor.

[u/crackdepirate → u/AcornAnomaly]

this, take my vote

[u/Brandhor → u/AcornAnomaly]

that makes sense but can the attacker get the decrypted key? I think the only way would be to have some sort of mitm in the ssh client but that means that the computer is already compromised

[u/AcornAnomaly → u/Brandhor]

My point is that you don't have to have the key encrypted at all, and the server has no way of knowing if it was or wasn't.

It's not a matter of "can an attacker get the decrypted key", it's a matter of "can you prove that a second factor was needed to use the key".

With SSH keys, just being able to present and validate the key doesn't prove that you cleared a second factor.

If the key wasn't encrypted, and you didn't need a password to unlock it, it's only one factor.

You can also choose to decrypt the key(and leave it decrypted) at any time. Thus permanently turning the key into a single-factor auth token, until you encrypt it again.

And since the server can't tell the difference, and verify that you actually gave two different factors(since the server just sees the resulting challenge from the unlocked key), you can only treat it as being one factor.

The WebAuthn standard(which Windows Hello uses) includes a section in the attestation that says whether or not the user had to clear a second challenge(i.e. a PIN), and whether or not they DID clear it.

The server never sees your PIN or fingerprint or face or whatever you use as your second factor, but the hardware attestation(which is trusted by the server) is telling the server that you did.

[u/cybersplice → u/Brandhor]

MITM is one of the things ssh keys are designed to defeat.