Page MenuHomeVyOS Platform

VyOS SSH TrustedUserCAKeys Limitation with X.509-only PKI
Closed, ResolvedPublicBUG

Description

In a typical system using OpenSSH, the TrustedUserCAKeys option allows SSH certificates to authenticate users securely. However, there is a bug in the VyOS implementation of this feature introduced in https://vyos.dev/T6013.

Current Problem:
  • The current VyOS configuration requires the TrustedUserCAKeys to be sourced strictly from the VyOS PKI module.
  • The VyOS PKI only accepts X.509 certificates as certificate authorities (CAs).
  • OpenSSH does not natively manage X.509 certificates. Instead, it uses OpenSSH certificates, which are a simpler, more direct implementation. More details on this difference can be found in this Smallstep blog post.
Possible Compatibility Issue:
  • For X.509 certificates, Roumen Petrov publishes custom OpenSSH builds with X.509 support, but it is unlikely that VyOS uses these builds. VyOS most likely ships with the native version of OpenSSH, which lacks native support for X.509 certificates but supports a lighter and less complex alternative. OpenSSH developers have maintained that the complexity of X.509 certificates introduces an unacceptable attack surface for sshd. Instead, they have implemented a simpler certificate format that is easier to parse and thus poses less security risk.
  • As it stands, this implementation does not work for environments relying on OpenSSH certificate-based authentication.

Possible Solutions:
  1. Add Support for OpenSSH CA Keys in VyOS PKI:
    • Allow the VyOS PKI to accept OpenSSH-style CA public keys (in ssh-rsa or similar formats), and make the SSH service retrieve the CA from this source instead of requiring an X.509 CA.
  1. Change SSH Configuration Behavior:
    • Enable VyOS to load the SSH CA public key directly from a local path (e.g., /etc/ssh/trusted-user-ca-keys.pem) or a remote path (e.g., https://vault.example.com/v1/ssh-client-signer/public_key).

Details

Version
1.5-rolling-202501270007
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)
Forum thread
https://forum.vyos.io/t/ssh-key-management/7251

Event Timeline

Viacheslav triaged this task as Normal priority.Feb 10 2025, 3:04 PM

@tarik.haddouchi
Hi Tarik-san,

I sincerely apologize for the bug in my implementation and for any inconvenience it may have caused.

Initially, the approach was to copy a PEM file from an arbitrary path to /etc/ssh/trusted-user-ca-keys.pem and read it from there. However, after the code review, we decided to switch to using the PKI framework instead. When I initially implemented it for my own use, I assumed that handling the file path alone would be sufficient, and as a result, I did not test it thoroughly. I deeply regret this oversight. 🙇‍♂️
https://github.com/vyos/vyos-1x/pull/4234

While using the PKI framework would provide better seamless integration for handling Principals in the long run, I believe that, for now, it would be more practical to revert to the previous approach of reading from a specified file path. I plan to work on this change.
The reason is that if we provide a simple mechanism where "the path specified in the VyOS CLI for trusted-ca-key-file" is directly reflected in the TrustedUserCAKeys setting in sshd_config, it would already be convenient and secure enough for users.

@takehaya
Hi Takeru-san,

No worries, and thank you very much for your contribution.
That's a great functionality—I hope it will be fixed soon.
Please let me know when it's ready so I can test it again.

This has been addressed in https://github.com/vyos/vyos-1x/pull/4266/ - we now support using openssh keys defined in the PKI subsystem as trusted root for TrustedUserCAKey.

Documentation has been updatedhttps://github.com/vyos/vyos-documentation/pull/1641

https://docs.vyos.io/en/latest/configuration/service/ssh.html#cfgcmd-set-service-ssh-trusted-user-ca-name