{"id":123013,"date":"2025-03-26T16:22:56","date_gmt":"2025-03-26T14:22:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect"},"modified":"2025-03-26T16:22:56","modified_gmt":"2025-03-26T14:22:58","slug":"kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","title":{"rendered":"Cloudflare has published opkssh for SSH authentication via OpenID Connect","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cloudflare has introduced the opkssh (OpenPubkey SSH) toolkit, allowing the integration of centralized authentication into OpenSSH with the ability to log in via OpenID Connect providers. With opkssh, you can eliminate manual tasks for managing and configuring SSH keys and establish connections to servers from any host, without the need to create private keys on each client computer or manually copy public keys to the server. To connect, it is sufficient to bind to the account with the OpenID provider on the server. The toolkit's code is written in Go and is distributed under the Apache 2.0 license. <\/p>\n

Opkssh is compatible with OpenID providers Google, Microsoft\/Azure, and Gitlab, allowing login through existing accounts in services such as gmail.com, microsoft.com, and gitlab.com. When using opkssh, instead of unlimited duration SSH keys, temporary keys are generated that remain valid for just a few hours and are created based on confirmation from the OpenID provider. The leakage of such keys after their expiration poses no security threat. By default, the duration of the key is 24 hours, after which the user must re-authenticate via OpenID. <\/p>\n

Integration with OpenSSH is based on the ability to create SSH protocol extensions that allow arbitrary data to be attached to SSH certificates. After authentication through OpenID, the client generates a public key containing a PK token that confirms the key's ownership by the asserted user. The token is integrated into the SSH protocol through a field with additional data in the SSH certificate. The creation and verification of PK tokens on the server side is carried out using the OpenPubKey cryptographic protocol. <\/p>\n

OpenPubKey allows for the generation of a public key and its association with a token issued by the OpenID provider. Through a digital signature, the provider confirms that this key was created by the authenticated user in question. For example, the Google OpenID provider can confirm that the user is authenticated as test@gmail.com. On the server side, a check is performed to verify whether the attached token was signed by the OpenID provider and if the digital signature corresponds to the claimed public key, which means the server can ascertain that the user test@gmail.com has created the public key for the connecting SSH client.

\"Cloudflare<\/center> <\/p>\n

Integration with OpenSSH is organized by specifying the program opkssh in the configuration file 'sshd_config' via the directive 'AuthorizedKeysCommand' (for example: 'AuthorizedKeysCommand \/usr\/local\/bin\/opkssh verify %u %k %t'). The setup for linking accounts with OpenID is carried out on the SSH server side. No changes are required on the SSH client side, but before logging in, you need to run the command 'opkssh login' and select the OpenID provider in the browser window that appears to perform authentication. <\/p>\n

The opkssh utility will generate SSH keys and obtain a PK token that confirms that the user has been authenticated and allows verification that the generated keys belong to the claimed user. The SSH public key, to which the PK token is attached via an additional data field, will be recorded in the file ~\/.ssh\/id_ecdsas and will begin to be transmitted upon connecting to server<\/a> the ssh utility. <\/p>\n

Connecting to the server is done using the standard SSH scheme 'ssh login@server', while on server<\/a> the login must first be identified with the OpenID account used by the user. Thus, the operation consists of the SSH client sending the public key to the SSH server, and the server running the command 'opkssh verify' to verify the key. <\/p>\n

To link an account to OpenID, the server administrator executes the command 'opkssh add'. For example, to allow logging into the server as the user 'root' with OpenID authentication using the test@gmail.com account in Gmail, the command 'sudo opkssh add root test@gmail.com google' should be executed, after which the client can connect using the parameters of this account with the command 'ssh root@host_server'. <\/p>\n

The account linking can also be done manually through the configuration file \/etc\/opk\/auth_id (or ~\/.opk\/auth_id), where for the above example, the line 'root test@gmail.com https:\/\/accounts.google.com' will be written. Additionally, through the file \/etc\/opk\/providers, you can define a list of acceptable OpenID providers, their parameters, and a list of allowed client identifiers.

\"Cloudflare<\/center>
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 opkssh (OpenPubkey SSH), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 OpenSSH \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u0445\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 OpenID Connect. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 opkssh \u043c\u043e\u0436\u043d\u043e \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u0440\u0443\u0447\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044e \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 SSH-\u043a\u043b\u044e\u0447\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0441 \u043b\u044e\u0431\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u043d\u0430 \u043a\u0430\u0436\u0434\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0438 \u0431\u0435\u0437 \u0440\u0443\u0447\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":123014,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123013","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cloudflare has released opkssh for SSH authentication via OpenID Connect | ProHoster","description":"Cloudflare has introduced the opkssh (OpenPubkey SSH) toolkit, enabling the integration of centralized authentication into OpenSSH with the possibility of logging in through OpenID Connect providers.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 opkssh \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 SSH \u0447\u0435\u0440\u0435\u0437 OpenID Connect | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 opkssh (OpenPubkey SSH), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 OpenSSH \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u0445\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 OpenID Connect.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/kompaniya-cloudflare-opublikovala-opkssh-dlya-autentifikaczii-v-ssh-cherez-openid-connect","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-26T14:22:58+00:00","article:modified_time":"2025-03-26T14:22:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123013","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:38:16","updated":"2026-02-09 22:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/123013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=123013"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/123013\/revisions"}],"predecessor-version":[{"id":160229,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/123013\/revisions\/160229"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/123014"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=123013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=123013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=123013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}