Skip to content

v0.22.0: SFTP certificates checked against the EuroHPC domain grant

Choose a tag to compare

View all tags
@tannevaled tannevaled released this 07 Oct 11:32
· 35 commits to main since this release
v0.22.0
b7b8230
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

SFTP certificates checked against the EuroHPC SSH CA profile's domain grant (ssh-domain-grant@core.aai.geant.org), through go-authn/sshcert v0.1.0.

  • ssh_domains = ["files.example.org"]: this host's names. A certificate signed by a trusted CA (trusted_user_ca_file, or the OIDC block's ssh_ca_file) is accepted only if its grant names one of them.
  • Fail-closed by default: a certificate with no grant is refused. ssh_accept_ungranted = true lets one in and logs it; a malformed grant is always refused.
  • Without ssh_domains, nothing changes, and a test proves it.
  • Metric: fileshare_sftp_domain_grant_total{result=…}.
  • Pairs with: go-authn/bridge v0.19.0's EFP-profile clients (ssh_domain_grants), and with EFP's own CA, whose key goes in trusted_user_ca_file.

Known limit: with ssh_domains set, a certificate carrying the source-address critical option is refused, even from an allowed address. The SFTP server checks these certificates with a CertChecker that refuses every critical option (go-filesystems/sftp). It fails closed.

go-authn/krl moves from v0.5.0 to v0.6.0, which sshcert requires.

Assets 2
Loading