Host-key rotation and more in OpenSSH 6.8

Ignore previous instructions; subscribe to LWN today

Every article on LWN.net is written by humans, for humans. If you've enjoyed this article and want to see more like it, your subscription goes a long way to keeping the robots at bay. We are offering a free one-month trial subscription (no credit card required) to get you started.

OpenSSH 6.8 was released on March 18. As usual, the update adds several additional features to the ssh client and sshd server; some of the changes are meant to ease the configuration or management of systems, while some are geared primarily toward better usability (a factor that, for SSH, can have genuine security implications). But there are other changes that introduce new functionality altogether, such as the ability to securely migrate from one SSH key to another, or the ability to require multiple keys to authenticate to a server.

The portable version of OpenSSH (that is, the package intended for operating systems other than OpenSSH's parent OS, OpenBSD) is available for download in source form. It will likely be a brief matter of time before most Linux distributions have packages available.

New major features

The new feature in version 6.8 that has prompted the most discussion is support for host-key rotation. Host-key rotation is an attempt to solve a longstanding problem: from time to time, servers need to retire an old SSH key and replace it with a new one, but swapping out keys without warning can leave clients unable to connect. Sometimes, the key replacement is precautionary (such as migrating to a stronger key algorithm), but key replacement may also be necessary in a hurry if a key is believed to be compromised.

With OpenSSH's rotation scheme, once a client has authenticated to a server, the server can send over a list of all of its supported keys. The client can store the list locally in its known_hosts file. Since each key record indicates the algorithm used, the next time a client connects, it can authenticate using a newer or stronger available key. The server, in turn, can eventually pull an old key out of the list and retire it. The client, when it connects with the new key, would update its list again and remove the now-absent old key from known_hosts.

This feature is experimental, though. In the comments on OpenSSH maintainer Damien Miller's initial blog post about the subject, some readers pointed out potential exploits. An attacker could slip an extra key into the list, for example, then subsequently proxy-connect clients to a different server. By trusting implicitly that the keys in known_hosts belong to who they claim to, the client would not know that the SSH session had been redirected. Miller then added a signature-checking step to the scheme, so that the client will verify that the key belongs to the server.

To do the signature check, the client sends a request (including a session identifier) for each new key that it sees. The server signs each of these requests with the private key that corresponds to the requested public key. That addition seems to have satisfied most of the commenters, but the story serves as a reminder that some real-world testing is highly advisable before deploying such a new feature in the wild.

Another new feature is support for multi-key authentication. In OpenSSH 6.2, the sshd daemon gained support for the AuthenticationMethods configuration directive, with which the server administrator can specify a multi-step authentication process. ``publickey,password'', for example, would require connecting clients to authenticate with a key, then with a password.

As of OpenSSH 6.8, ``publickey,publickey'' is a supported authentication combination. It requires clients to authenticate with two separate keys. Other combinations with additional directives are possible, too, as is requiring three or more keys.

There is also one important change in 6.8 that may require server administrators to alter their sshd configurations. In older versions of OpenSSH, the sshd daemon would perform reverse DNS lookups on connecting clients (logging suspicious results). There were a few objections to this. For one thing, high-traffic servers were doing a lot of DNS queries (adding to system load). For another, as Daniel Kahn Gillmore pointed out in November 2014, the lookups added no real security benefit. In fact, they could even pose a security risk, he said in a follow up, since buggy DNS resolvers could be used to mask an attacker's activity. As of OpenSSH 6.8, then, the DNS lookup feature has been turned off by default. Servers that make use of it will need to have their configuration files updated to switch the feature back on.

New minor features

While the host-key rotation and multi-key authentication features permit OpenSSH users to implement some new functionality, there are a great many more improvements in the new release that merely simplify configuration or make day-to-day usage a better experience. For instance, several enhancements were made to host-based authentication. Both the client and server configuration files can now include a directive specifying what public key types are used to connect for host-based authentication, and Ed25519 keys are supported.

Key-revocation lists (KRLs) were another feature introduced in version 6.2, and were also the target of some small enhancements. Up through OpenSSH 6.7, the use of KRLs required that OpenSSH be compiled with OpenSSL support; this is now no longer needed. A RevokedHostKeys option was added to the ssh client, allowing the user to revoke keys with a KRL or with a text file. KRLs can also revoke X.509 certificates and, as of version 6.8, they can do so without also needing to specify the certificate authority (CA) that issued each certificate.

Both the ssh client and sshd server have a new FingerprintHash option, available as a command-line flag and as configuration-file option, that lets users specify the algorithm used to generate a key fingerprint. In conjunction with this change, the format OpenSSH uses to print out a key fingerprint has been updated; it now prepends the name of the algorithm used, for easy reading.

Anyone still using version 1 of the SSH protocol (which is hopefully not a large group) can rest easier in at least one respect tonight: OpenSSH 6.8 adds a workaround that blocks the new Bleichenbacher side-channel attack disclosed by Christopher Meyer and associates in 2014. At the other end of the ancient-to-contemporary spectrum, users who use IPv6 addresses on their machines will be happy to hear that version 6.8 fixes an annoying bug in which OpenSSH tried to parse some IPv6 addresses as hostnames.

There are, of course, many more small changes and updates not addressed here. Partial authentication successes are no longer counted as authentication failures against the MaxAuthTries limit, ssh matching rules now support the negation operator (e.g., Match !foo), and so forth.

Moving forward, it will be worth paying attention to the real-world feedback generated by users testing out the host-key rotation feature. System administrators have dealt with key rotation in a variety of ways in the past, with no real standard, so OpenSSH's venture into the fray could have a lasting impact. In the meantime, there are enough new additions to OpenSSH to make it worth exploring for its other improvements as well.

Index entries for this article
Security	OpenSSH

---

to post comments