I have a Windows 7 machine which is not part of domain, and a Linux machine.
I want to login to Linux from Windows using an x509 certificate stored in windows certificate store.
Is it possible?
I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will automatically be granted access to the linked user account. RFC 6187 seems to suggest such a functionality
I don't want to to install keys for each user instead of just CA certificate and a machine certificate and mapping certificate DN to host usernames to authorize.
From Windows CA to issue certificate to authenticate SSH to a Linux server it seems it is only possible with a forked OpenSSH server. Following an answer there
I'm not inclined to diverge from the main branch of OpenSSH myself, security is too important and I don't have the resources to properly verify this significant of a change
The patch is 200KB long, too easy to shoot yourself in the foot with such type unsafe language as C without a large community the main OpenSSH branch has. Moreover, it seems to implement an older draft instead of RFC 6187
OpenSSH community is not interested in x509 because it's a pain to work with such a large specification:
The developers have maintained a stance that the complexity of X.509 certificates introduces an unacceptable attack surface for sshd. Instead, they have [recently] implemented an alternative certificate format which is much simpler to parse and thus introduces less risk.
The above "alternative certificate format" is not a good idea to me either. X.509 is widely supported, so 2 certificates and 1 private key can serve in many different places, e.g. in TLS, IPSec, S/MIME and other applications of CMS. Moreover centralized revocation similar to CRLs is not supported so the revocation of "alternative certificates" with compromised private keys is tedious and error-prone.
So far the only viable option is GSSAPI - it is even supported by PuTTY.
Is there anything else to simplify SSH key management?