add SSH key verification option

[aaronpk]

http://superuser.com/a/308130

requested by @JerrySievert

[valpackett]

https://vtllf.org/blog/ssh-web-sign-in.html

[aaronpk]

That URL apparently changed to https://vtllf.org/sshweb

[singpolyma]

Could do it using the signing method linked, or (easier) provide ssh login to a space with the key that is set to only execute a command that triggers continuance. Provide an ssh:// URI and/or instructions on running ssh user@ssh.indieauth.com -- login and after running such the login would proceed.

[aaronpk]

Yeah I re-read that post and I'm not quite sure how to make that flow work here.

[singpolyma]

The signing-based or the login-based flow? Where are you hosted right now?

[aaronpk]

indieauth.com runs on three servers that don't share any state between them, so I'd probably run the SSH agent on only a single server (similar to how openid.indieauth.com works). The main server is a linode VPS.

I'd be happy to take suggestions on how an expected flow would work with SSH verification.

[singpolyma]

So, the login-based on would involve ssh keys set up to only be allowed to run a single command (this is a standard sshd feature of the authorixed_keys file) so I would probably be a command run via such a key that would set something in the DB to mean "yes, approve login" and then the web frontend would just spin until the backend saw that value set (or similar) and then approve login (or timeout after some time)