Using SSH Keys for http user verification

Question

This is most likely not possible, but I'm just asking this to check... I'm just thinking out loud here...

So, SSH keys are very useful for logging into a server. Use SSH, and your SSH keys increase security to the server while also making it easier to manage several servers or other programs with one SSH key. Also, by unlocking the key when you login, there is even less need to type the password over and over again. So, I was wondering... is there a way to use SSH keys for website user verification? I am not talking about large, public websites, but about small, controlled systems that are used by specific users whose OS/browser can be controlled. Is there a way to integrate this? For this to work I assume the private key would need to be transferred over the web, so let's say we have SSL running to make this not insecure. Is such a thing possible? In an ideal situation, I log in to a website and it will see that my private key matches the public key that is installed, and voilá, I'm in!

score 3 · Accepted Answer · answered Dec 03 '11 at 20:42

3

It's called a client certificate, and you import it into your browser.

answered Dec 03 '11 at 20:42

The Nail

8,355
2
35
48

score 1 · Answer 2 · answered Dec 04 '11 at 08:25

1

From technical point of view SSH keys represent public key cryptography scheme, and this is what X.509 certificates do in SSL. So what you need is certificates (client-side one if you want to authenticate the client on the server).

And no, private keys are never transferred across the net. They are used in certain operations for exchange of session key.

answered Dec 04 '11 at 08:25

Eugene Mayevski 'Callback

45,135
8
71
121

Yes, private keys are often transferred across the net (albeit safer to deliver these in person). The challenge is to do this securely, by using a secure channel and password protected certificate files. – The Nail Jan 15 '12 at 15:26
@TheNail it makes sense to also check context before writing. In context OP was writing about they are not. – Eugene Mayevski 'Callback Jan 15 '12 at 18:23

score -1 · Answer 3 · edited Mar 01 '13 at 04:47

-1

AuthUserFile /home/hafizni/.htpasswd
AuthGroupFile /home/hafizin/.htgroup
AuthName hafizin page
AuthType Basic
require group my-users

edited Mar 01 '13 at 04:47

animuson

53,861
28
137
147

answered Mar 01 '13 at 04:28

hafizin

1

Using SSH Keys for http user verification

3 Answers3

Linked