Proposal: support ssh certificates

[42wim]

Description

Support ssh certificates

This way users can get access without uploading a public ssh key, instead they are verified against a ssh CA.

This will need extra sshd configuration like this

AuthorizedPrincipalsFile .ssh/authorized_principals
TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem

.ssh/authorized_principals basically need to output the same as the authorized_keys file eg

command="/app/gitea/gitea serv key-1 --config='/data/gitea/conf/app.ini'",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty principal

The difference is the principal instead of the ssh key, this should match the valid principals in your ssh certificate.

In our case this will match with the usernames in gitea.

In the GUI there should be an option for a user to:

• activate this feature
• maybe specify the principal that should be matched (default username)

In the configfile, there should be an option to specify the system-wide CA (the contents of /etc/ssh/trusted-user-ca-keys.pem)

It's possible to fit this in the public_key table by putting the correct principal in the content field instead of the ssh-key

I'm prepared to work on this.