A flexible authorization layer for OpenSSH certificate-based authentication using host identities and grants.
HIBA is an authorization system built on top of OpenSSH certificate-based authentication. It enables flexible, policy-driven access control by attaching host identities and user grants as extensions to SSH certificates, allowing target hosts to dynamically authorize users without manual configuration updates. It solves the problem of managing SSH access across large, dynamic host pools with minimal operational overhead.
System administrators, DevOps engineers, and security teams managing SSH access in environments with many hosts, especially those requiring granular, auditable access controls without relying on centralized authorization services.
Developers choose HIBA because it extends OpenSSH's native certificate authentication with fine-grained, declarative authorization policies, eliminating the need to push authorized_keys files. Its local evaluation makes it robust for low-dependency or last-resort access scenarios.
HIBA is a system built on top of regular OpenSSH certificate-based authentication that allows to manage flexible authorization of principals on pools of target hosts without the need to push customized authorized_users files periodically.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses OpenSSH's AuthorizedPrincipalsCommand to invoke hiba-chk at connection time, enabling real-time authorization without pushing authorized_keys files, as described in the README.
Allows defining host identities (e.g., domain, owner) and user grants with constraints, enabling precise matching for authorization decisions based on host properties.
Authorization is performed locally on target hosts via hiba-chk, making it suitable for last-resort or isolated SSH access without external services, as highlighted in the key features.
Host identities and grants support custom fields beyond the mandatory 'domain', allowing adaptable policy definitions to match diverse infrastructure needs.
Requires OpenSSH certificate-based authentication and specific versions (6.9+ for AuthorizedPrincipalsCommand, 7.4+ for tokens), adding significant initial configuration overhead, as noted in the prerequisites.
Individual grant revocation is not yet implemented; the README admits relying on short-lived certificates or full certificate revocation, which may not meet all operational needs.
The HIBA library is explicitly not thread safe, requiring callers to manage locking, complicating integration into multi-threaded certificate authorities, as warned in the developers section.