Add support for SSH certificate-based authentication

[brncsk]

Something along the lines of https://carlosbecker.com/posts/golang-ssh-client-certificates/ would be nice.

For others coming here not understanding why their cert-based auth fails, one reason for getting the following error could be that you are authenticating using the private key, but (unlike ssh CLI, which appends -cert.pub to the -i flags value), Pulumi does not try to find the cert automatically:

after 1 failed attempts: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain

[blampe]

Hi @brncsk, could you share the code you're using that's causing the error?

but (unlike ssh CLI, which appends -cert.pub to the -i flags value), Pulumi does not try to find the cert automatically:
...
attempted methods [none publickey]

From the error message it seems a public key was indeed provided to the server. Are you sure the remote end is configured correctly, and the cert is correct?

[brncsk]

Hi @blampe,

From the error message it seems a public key was indeed provided to the server. Are you sure the remote end is configured correctly, and the cert is correct?

Yes, I'm sure. The remote sshd is correctly configured for cert-based auth, and I can authenticate successfully by providing the -i flag to ssh(1) and specifying my keyfile.

The problem is that there's an implicit logic in ssh(1) that, when provided with a private key using the -i flag, also looks for a matching *-cert.pub file in the same directory, and uses that as the cert.

The man page provides more information (look for the section on the -i identity_file flag.)

My understanding is that for cert-based auth, you must provide both the key and the cert to the server, and pulumi-command provides no facility for the latter.

[mjeffryes]

I'm afraid I wasn't able to reproduce this on my machine. I'm running on Darwin 14.7 targeting a panubo/docker-sshd ssh server running in docker. Here's the program I used:

import * as command from "@pulumi/command";
import * as fs from "fs";


const privateKey = fs.readFileSync("id_rsa", "utf8");

const cmd = new command.remote.Command("example", {
  create: "echo 'Hello, World!'",
  delete: "echo 'Goodbye, World!'",
  connection: {
    host: "localhost",
    port: 2222,
    user: "www",
    privateKey
  }
}, {
})

export const output = cmd.stdout

[brncsk]

@mjeffryes Have you set up certificate-based authentication in sshd?

If you have not, this post explains how to do so: https://goteleport.com/blog/how-to-configure-ssh-certificate-based-authentication/