Auth using OIDC

[joeblew999]

https://github.com/openpubkey/opkssh

Would make it easier for many .

Authelia for example is working on supporting it.

It’s in many ways more secure since you can use passkeys with Authelia .

[dimonomid]

Hi there,

Yeah I don't disagree it's more secure, but could you elaborate on how would it make it easier as you mentioned? What's your use case exactly?

Following the readme on https://github.com/openpubkey/opkssh, it's possible to do opkssh login first, and then use Nerdlog or whatever else to ssh-authenticate using the ~/.ssh/id_ecdsa key. Do you mean that we could eliminate the opkssh login step, and make it a part of Nerdlog?

[joeblew999]

No

It’s means the server generates the ssh keys at runtime . The client on receiving the keys then uses them.

So you can roam , log in using anything , like a pssskey or email / password , and connect over ssh to get the logs streaming back to you .

I don’t like ssh keys floating around on users devices . This removes that security problem to a degree.

It’s great that this is being embraced

[cluster2600]

I have implemented that In my fork, please check my pull request

[joeblew999]

@cluster2600 nice 👍

[dimonomid]

As mentioned in the review, this PR smells 100% AI-generated: there are a bunch of incoherent changes (the new config option which isn't even used, the method returning an interface{} for no good reason, misplaced and very AI-style docs, the ssh-config changes are still present after agreeing to remove them, etc).

I doubt we can get much out of this PR as it is tbh.