Smallstep Blog

Unix starts at root, which is how nature intended. It does not change characteristics based on media - you can mount a floppy at root if you want. Why get upset over /media vs /mnt? You do you, I know I do. For example The Step CA docs encourage using /etc/step-ca/ (https://smallstep.com/docs/step-ca/certificate-authority-server-produc… for configuration for their product. Normally I would agree but as I am manually installing this thing myself and not following any of the usual docs, I've gone for /srv/step-ca. I think we get enough direction from the ... "standards" ... for Unix file system layouts that any reasonably incompetent admin can find out which one is being mildly abused today and get a job done. On Windows ... good luck. I've been a sysadmin for both platforms for roughly 30 years and Windows is even odder than Unix.

If you really want to keep things local without paying any fees, you could also use Smallstep (https://smallstep.com/) to issue certificates for your services. This way you only need to add one CA to your trust store on your devices, and the certificates still renew periodically and satisfy the requirements for TLS. I suggested using a domain given they already have Caddy set up and it's inexpensive to acquire a cheap domain. It's also less of a headache in my experience.

I have a rather powerful dev box, on which I run yggdrasil[1]. With my mobile unit laptop, that self-hosted dream is a reality. PowerDNS[2] with admin[3] and smallstep[4] are the cherry on top. [1] https://yggdrasil-network.github.io/ [2] https://www.powerdns.com/ [3] https://github.com/PowerDNS-Admin/PowerDNS-Admin [4] https://smallstep.com/

I was familiar with the CNAME workaround, but it's not practical, since I'd have to manage X different zones, one for each redirection. I thought about abusing DuckDNS or something similar for this, but I figured it wouldn't be fair, so I never did. At one point I set up an internal Smallstep CA [0], which kinda worked but was pretty fragile, so I abandoned it. I didn't know about ACME-DNS. It looks interesting, but for the time being tunneling everything through Cloudflared works well enough for my needs. [0] https://smallstep.com/

I've written about the CA for Smallstep: https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi-yubikey/ I'd LOVE to write more about my homelab, but it's a work in progress that continues to evolve, and I haven't documented things as well as I'd like to!

Smallstep | SF, CA | REMOTE We are an open source / open core company that builds automated certificate management for DevOps. Our stuff makes it easy for developers to implement best practices in their security infrastructure. We need: - Full stack web/UI (mostly Node.js, TypeScript, React) - Core engineering (mostly Go, running on Kubernetes/GKE) - Developer advocate We're a small but growing team, and this is the ideal time to come in and be able to make a big impact while working alongside other smart and experienced developers. https://smallstep.com/careers

This is exactly right. PKI is for everyone. It's really quite simple once you learn how it works! Here's a great explanation that covers a ton: https://smallstep.com/blog/everything-pki/

https://smallstep.com/ One example. I have been testing smallstep, which puts IDP around ssh (with group management), and also includes a dynamic host catalog (hosts run an agent that phones home to your identity provider). However, I am very excited about Boundary as it seems to be a much more comprehensive solution.

I use step-ca [0] for these sort of things and it works brilliantly. I barely see the point of having external DNS servers resolving your internal infrastructure. [0] https://smallstep.com/certificates/

Check out our single sign-on for SSH stuff at smallstep (where I work). Either in open source[1] or our product[2]. The hassle of 2FAing all the time is one of the big reasons I love single sign-on for SSH. Basically, you do 2FA when you're pushed through single sign-on. But then you're issued a short-lived certificate that gets put in your ssh-agent. You only need to 2FA to get a certificate. So you can tune 2FA challenge frequency based on certificate lifetime. It's sort of like a browser session where you "login" and then you can browse until your cookie expires. Here you "login" and you can SSH until your certificate expires. So you have strong authentication, but you're only asked to do it periodically. [1] https://smallstep.com/blog/diy-single-sign-on-for-ssh/ [2] https://smallstep.com/sso-ssh/

Agree. It triggers me a little when folks complain about HTTPS. Nowadays you have a wealth of tools to trivialize TLS certificate tasks. Public TLS cert? LetsEncrypt + certbot (or any of the other zillion great ACME clients/libraries out there). Self-hosted PKI for private/test use? Smallstep CLI (https://smallstep.com/docs/step-cli/) is good. And honestly, the raw `openssl` commands to barf out a root selfsigned cert aren't that difficult and number as less than 5 shell invocations that you could have in your history or a bash function or something. Self-hosted PKI with extra steps that you already did because you have a Kubernetes cluster for some other reason? cert-manager will take care of pretty much everything. These days the "hardest" part is sneaking your CA chain into the appropriate browsers / services you're using/testing, but even that is a few moments of inconvenience at best.

Hmm interesting. Considering memory corruption vulnerabilities have been pretty much the vast rarity in the OpenSSH codebase, and other classes of vulnerabilties have been more common, I'm curious to know what you're doing to address those classes of vulnerabilities as well as support for other best practices like SSH certificates? [2] I think I see the appeal of an entirely memory-safe OS running an entirely memory-safe SSH implementation because if we're talking about eliminating that class of vulnerability, you might as well go the whole hog - I just don't see that close to the point of being battle tested yet nor taking care of stuff like side channel attacks or tricking people into thinking their TOFU isn't smelly. I like your project because I think that this stuff is important, I think it's just like "how do you improve on the original" may actually be more than just eliminating one class of vuln. [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=openssh [2] https://smallstep.com/blog/use-ssh-certificates/

> By the way, EasyRSA still isn't that easy, but it's better than using OpenSSL directly. The trouble with EasyRSA (and similar tools) is that they make decisions for you and restrict what's possible and how. For example, I would always use name constraints with private roots, for extra security. But you're right about OpenSSL; to use it directly requires a significant time investment to understand enough about PKI. I tried to address this problem with documentation and templates. Here's a step by step guide for creating a private CA using OpenSSL, including intermediate certificates (enabling the root to be kept offline), revocation, and so on: https://www.feistyduck.com/library/openssl-cookbook/online/ch-openssl.… Every aspect is configurable, and here are the configuration templates: https://github.com/ivanr/bulletproof-tls/tree/master/private-ca Doing something like this by hand is a fantastic way to learn more about PKI. I know I enjoyed it very much. It's much easier to handle because you're not starting from scratch. Others in this thread have mentioned SmallStep's STEP-CA, which comes with ACME support: https://smallstep.com/docs/step-ca/getting-started That's definitely worth considering as well. EDIT The last time I checked, Google's CA-as-a-service was quite affordable https://cloud.google.com/certificate-authority-service AWS has one too, but there's a high minimum monthly fee. Personally, if the budget allows for it, I would go with…

Hello HN! We’re Ben, Aanand, Carl, Eva, and Mark, and we made the Command Line Interface Guidelines. Earlier this year, I was working on the Replicate CLI [0]. I had previously worked on Docker so I had a bunch of accumulated knowledge about what makes a good CLI, but I wanted to make Replicate really good, so I looked for some design guides or best practices. Turns out, nothing substantial had been published since the 1980s. On this search I found a superb blog post by Carl about CLI naming [1]. He must be the only person in the world who cares about CLI design and is actually a good writer, so we teamed up. We also were joined by Aanand, who did loads of work on the Docker CLIs; Eva, who is a technical writer, to turn our scrappy ideas into a real piece of writing; and Mark, who typeset it and made a super design. We love the CLI, but so much of it is a mess and hard to use. This is our attempt to make the CLI a better place. If you’re making a tool, we hope this is useful for you, and would love to hear your feedback. Some of it is a bit opinionated, so feel free to challenge our ideas here or on GitHub! [2] We’ve also got a Discord server if you want to talk CLI design. [3] [0] https://replicate.ai/ [1] https://smallstep.com/blog/the-poetics-of-cli-command-names/ [2] https://github.com/cli-guidelines/cli-guidelines [3] https://discord.gg/EbAW5rUCkE

Are you aware of https://smallstep.com?

I like using short-lived SSH certificates, and avoiding long-lived keypairs entirely. Vendor post but it summarises the operational and security problems well. https://smallstep.com/blog/use-ssh-certificates/

SSH does have a certificate format that can place restrictions on what the user can do when connecting with that key. I'm not so sure about the hostkey side of things though. For example: https://smallstep.com/blog/ssh-vs-x509-certificates/#certificate-struc… you can see here that X11 forwarding is permitted for this certificate, among other things.

There are numerous tutorials on running your own private certificate authority (CA): * https://smallstep.com/blog/private-acme-server/ ; https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi-yubikey/ * https://openvpn.net/community-resources/setting-up-your-own-certificat… * https://www.digitalocean.com/community/tutorials/how-to-set-up-and-con… Import the CA's root cert on your browsing devices and anything it issues will be trusted.

What about something like step-ca? I got the free version working easily on my home network. https://smallstep.com/docs/step-ca/

Check out Smallstep’s step-ca server [0]. It still requires some work, but it allows you to run your own CA and ACME server. I have nothing against just hosting records off of a subdomain and using LE as mentioned, but I personally find it satisfying to host everything myself. [0] https://smallstep.com/docs/step-ca/

Smallstep CA might be interesting for you too. It’s open source. https://smallstep.com/docs/step-ca/getting-started/

Hey, have a look at this https://smallstep.com/blog/use-ssh-certificates/

If you want to do the mTLS, I’d also suggest step-ca [0], it’s an open source TLS and SSH CA. You can setup a variety of methods to be the identity provider, then have step provide the certs 0: https://smallstep.com/docs/step-ca/

Most people will use nginx-proxy [0] or Traefik [1] for front ending home labs with LetsEncrypt certs... Beyond that people will protect them with things like Tailscale [2], Cloudflare Tunnels [3] or even just mTLS [4] for protected access. Home labbing today has a lot of amazing software and it's hard to keep up! And as for dashboarding [5] on top of all this there are a lot of options. Also, for those new to the game who want an easier way to approach take a look at Tipi [6]. [0] https://nginxproxymanager.com/ [1] https://traefik.io/traefik/ [2] https://tailscale.com [3] https://developers.cloudflare.com/cloudflare-one/connections/connect-n… [4] https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi-yubikey/ [5] https://selfh.st/apps/?tag=Dashboard [6] https://runtipi.io/

Purely for the SSH part if you’re uncomfortable using anything outside of OpenSSH itself for authentication you could consider certificates[^1] You’d still need something to sign the certificates based on some other identity of course (it can be done manually but kind of defeats the purpose) be it smallstep or something else [^1]: https://smallstep.com/blog/use-ssh-certificates/

Some might argue SSH certificates are even better: https://smallstep.com/blog/use-ssh-certificates/

> you can't create certificates this way Sure I can. It's my network, so I decide what root CAs are trusted. Be your own CA, and tell your computers to trust your own CA cert. For example: https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi-yubikey/ or https://github.com/jsha/minica

Not really, with an SSH CA you’re trusting the CA and not installing individual keys into authorized_keys files. Anything signed by the SSH CA will work for logins. To deal with the “untrust” issue it’s normal for operations with an SSH CA to rely on (very) short-lived certificates, meaning often issued and valid for < 24 hours (it’s configurable, I’ve seen this be as short as 30 minutes). Smallstep wrote a summary here which is pretty good — https://smallstep.com/blog/use-ssh-certificates/

I haven't used it (so I might be excluded from answering your question), but I think SmallStep may be relevant to you. https://smallstep.com/docs/certificate-manager/acme/ At least they are doing a lot of "your own organizational PKI" tools and they care about ACME integration.

Related, I also saw this project a little while ago: https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi-yubikey/ Which looks quite interesting to have HTTPS for my internal-only pages without need to deal with an external service, although you have to be very careful to setup your certs correctly with "Name Constraints" (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) to avoid the risk of someone being able to MitM everything if they're able to get in and start issuing themselves certificates.