On Tue, May 25, 2010 at 22:27, Brian Demers <[email protected]> wrote: > Ahh, originally I was thinking this list was specific for sshd, I didn't > pay close enough attention to the list address it seems. > > My question is specific to org.apache.sshd.server.PublickeyAuthenticator. > It has a single method: > boolean authenticate(String username, PublicKey key, ServerSession session) > > > My implementation just checks if the a user (specified by the username > parameter) has the same public key. We check for the key equality with > another PublicKey the server already knows about. If the two keys match, we > happily return true. > > We do nothing with the ServerSession. > > Is comparing two PublickKeys ( and username ) enough? Are there any other > security concerns that I should have?
Yes, an additional check could be to check if the key has been revoked somehow, but the only thing you need to do is make sure you accept the user associated with the key. The SSH protocol will ensure that the user has the corresponding private key. > > Is anyone already using Shiro / JSecurity for authorization ? Not me, but if you want to provide the authenticators, we may be able to include them in the trunk. > > Thanks, > -Brian > > > On Tue, May 25, 2010 at 8:57 AM, David Latorre <[email protected]> wrote: > >> Hello Brian, >> >> I don't fully understand your question but the TLS handshake with >> client-authentication is described in wikipedia at: >> >> http://en.wikipedia.org/wiki/Transport_Layer_Security#Client-authenticated_TLS_handshake >> >> You can see that the client uses its private key in order to sign some >> of the 'handshake messages' (Certificate, ClientKeyExchange ) so in >> order to authenticate a client, you should also check with the >> client's public key that this signature is correct. >> >> >> >> 2010/5/24 Brian Demers <[email protected]>: >> > I have a PublickeyAuthenticator, it is a pretty simple, I just check if >> a >> > public key is valid. >> > >> > I am just trying to verify this is all I need to worry about. >> > Without knowing the details of ssl handshake, it struck me as odd to >> just >> > compair two public keys. Obviously the server does not have the clients >> > private key. >> > >> > Just looking for a little reassurance. ( that I can add to my javadoc ) >> > >> > Also, anyone interested in an Apache Shrio (getting out of the incubator >> > soon ) PasswordAuthenticator/PublickeyAuthenticator impl? (maybe a sub >> > project?) >> > >> > Thanks, >> > -Brian >> > >> > -- Cheers, Guillaume Nodet ------------------------ Blog: http://gnodet.blogspot.com/ ------------------------ Open Source SOA http://fusesource.com
