How does HIBA compare to using plain SSH certificates?

HIBA extends OpenSSH certificates with host identity and grant extensions for fine-grained, policy-driven authorization, whereas plain certificates only authenticate users without dynamic access control based on host metadata. This makes HIBA more scalable for large infrastructures but adds complexity.

How to integrate HIBA with an existing OpenSSH certificate authority?

Use the HIBA API from extensions.h to generate and attach host identity or grant extensions to certificates, then configure sshd with AuthorizedPrincipalsCommand to call hiba-chk. The README provides example CA documentation, but it requires modifying CA workflows to include HIBA extensions.

Does HIBA work with cloud VMs like AWS EC2 instances?

Yes, HIBA can be used with cloud instances by defining host identities with fields like location or owner, and grants that match those properties. However, you must ensure OpenSSH certificate authentication is set up and hiba-chk is installed on target hosts.

What's the performance impact of hiba-chk on SSH logins?

hiba-chk runs locally during SSH connection setup, adding minimal latency as it only parses certificate extensions and compares grants to host identity. The README emphasizes low dependency, but in high-traffic environments, ensure adequate host resources.

Can HIBA be used for auditing SSH access?

Yes, HIBA enables auditable access control because grants and host identities are embedded in certificates, providing a traceable policy framework. However, logging must be configured separately in OpenSSH to capture hiba-chk decisions.

HIBA or FreeIPA for SSH access control?

HIBA is decentralized and uses OpenSSH certificates for local authorization, ideal for low-dependency setups, while FreeIPA offers centralized management with LDAP/Kerberos but requires ongoing server connectivity. Choose HIBA for isolated access, FreeIPA for integrated identity management.

Open-Awesome

HIBA

BSD-3-ClauseC

A flexible authorization layer for OpenSSH certificate-based authentication using host identities and grants.

Visit Website GitHub

390 stars18 forks0 contributors

What is HIBA?

HIBA is an authorization system built on top of OpenSSH certificate-based authentication. It enables flexible, policy-driven access control by attaching host identities and user grants as extensions to SSH certificates, allowing target hosts to dynamically authorize users without manual configuration updates. It solves the problem of managing SSH access across large, dynamic host pools with minimal operational overhead.

Target Audience

System administrators, DevOps engineers, and security teams managing SSH access in environments with many hosts, especially those requiring granular, auditable access controls without relying on centralized authorization services.

Value Proposition

Developers choose HIBA because it extends OpenSSH's native certificate authentication with fine-grained, declarative authorization policies, eliminating the need to push authorized_keys files. Its local evaluation makes it robust for low-dependency or last-resort access scenarios.

Overview

HIBA is a system built on top of regular OpenSSH certificate-based authentication that allows to manage flexible authorization of principals on pools of target hosts without the need to push customized authorized_users files periodically.

Use Cases

Best For

Managing SSH access in large-scale, dynamic infrastructure (e.g., cloud or container fleets)
Enforcing role-based or attribute-based access control for SSH without centralized servers
Implementing last-resort or emergency access systems with minimal external dependencies
Auditing and compliance for SSH access through certificate-bound policies
Simplifying SSH key distribution and revocation in multi-team environments
Building custom certificate authorities with extended authorization capabilities

Not Ideal For

Teams not yet using OpenSSH certificate-based authentication for SSH access
Organizations requiring instant, centralized revocation of individual user grants without certificate expiration
Small-scale environments with static SSH policies where manual authorized_keys management suffices

Pros & Cons

Pros

Dynamic Policy Enforcement

Uses OpenSSH's AuthorizedPrincipalsCommand to invoke hiba-chk at connection time, enabling real-time authorization without pushing authorized_keys files, as described in the README.

Fine-Grained Access Control

Allows defining host identities (e.g., domain, owner) and user grants with constraints, enabling precise matching for authorization decisions based on host properties.

Low Infrastructure Dependency

Authorization is performed locally on target hosts via hiba-chk, making it suitable for last-resort or isolated SSH access without external services, as highlighted in the key features.

Flexible Metadata Support

Host identities and grants support custom fields beyond the mandatory 'domain', allowing adaptable policy definitions to match diverse infrastructure needs.

Cons

Complex Setup Requirements

Requires OpenSSH certificate-based authentication and specific versions (6.9+ for AuthorizedPrincipalsCommand, 7.4+ for tokens), adding significant initial configuration overhead, as noted in the prerequisites.

Limited Grant Revocation

Individual grant revocation is not yet implemented; the README admits relying on short-lived certificates or full certificate revocation, which may not meet all operational needs.

Non-Thread-Safe Library

The HIBA library is explicitly not thread safe, requiring callers to manage locking, complicating integration into multi-threaded certificate authorities, as warned in the developers section.

Frequently Asked Questions

Related Projects

DEPRECATED A dev tool for SSH auth + Git commit/tag signing using a key stored in Krypton.

Stars1,571

Forks108

Last commit2 years ago

totp-ssh-fluxer

Take security by obscurity to the next level (this is a bad idea, don't really use this please)

Stars946

Forks43

Last commit4 years ago

authy-ssh

Easy two-factor authentication for ssh servers

Stars793

Forks67

Last commit8 years ago

github-auth

SSH key management for GitHub users

Stars390

Forks17