[GH-ISSUE #475] Feature Request: `*-sk` keys supporting PIV-like policies #121

New issue

Open

opened 2026-05-07 00:19:11 +02:00 by BreizhHardware · 1 comment

BreizhHardware commented

2026-05-07 00:19:11 +02:00

Owner

Originally created by @codyro on GitHub (Apr 23, 2024).
Original GitHub issue: https://github.com/ovh/the-bastion/issues/475

Now that The Bastion supports *-sk keys, it would be nice to have PIV-like policies available to limit keys to an account to PIV/SK/FIDO2, grace periods, etc. It could potentially utilize PubkeyAuthOptions in some capacity.

Please close this if it seems like a stinker of an idea :).

Originally created by @codyro on GitHub (Apr 23, 2024). Original GitHub issue: https://github.com/ovh/the-bastion/issues/475 Now that The Bastion supports `*-sk` keys, it would be nice to have PIV-like policies available to limit keys to an account to PIV/SK/FIDO2, grace periods, etc. It could potentially utilize [`PubkeyAuthOptions`](https://man.openbsd.org/sshd_config#PubkeyAuthOptions) in some capacity. Please close this if it seems like a stinker of an idea :).

BreizhHardware added the

feature

label

2026-05-07 00:19:11 +02:00

BreizhHardware commented

2026-05-07 00:19:11 +02:00

Author

Owner

@speed47 commented on GitHub (May 22, 2024):

Well, that would completely make sense indeed!

Contrary to e.g. "RSA GPG keys used as SSH keys through gpg-agent's ssh-agent compatibility layer", where, on server side, we have no way to differentiate between such a (hardware) key and an RSA key stored in a file, the *-sk series does guarantee that, as PIV does.

I'll check the feasibility, but I like the idea!

@speed47 commented on GitHub (May 22, 2024): Well, that would completely make sense indeed! Contrary to e.g. "RSA GPG keys used as SSH keys through `gpg-agent`'s `ssh-agent` compatibility layer", where, on server side, we have no way to differentiate between such a (hardware) key and an RSA key stored in a file, the `*-sk` series does guarantee that, as PIV does. I'll check the feasibility, but I like the idea!

BreizhHardware referenced this issue

2026-05-07 00:20:01 +02:00

[PR #121] [MERGED] fix: osh-lingering-sessions-reaper.sh: tocttou on kill #254