Skip to content

Commit 90b69ff

Browse files
dgarskedgarske
authored
Merge pull request #754 from aidangarske/tpm_ssh_support
wolfSSH support for using TPM based key for authentication
2 parents e5042df + a52c3b1 commit 90b69ff

File tree

14 files changed

+1078
-136
lines changed

14 files changed

+1078
-136
lines changed

‎.github/workflows/tpm-ssh.yml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
name: TPM SSH Test
2+
3+
on:
4+
push:
5+
branches: [ '*' ]
6+
pull_request:
7+
branches: [ '*' ]
8+
9+
jobs:
10+
test-tpm-ssh:
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
- uses: actions/checkout@v4
15+
with:
16+
path: wolfssh
17+
18+
# Clone dependencies
19+
- name: Clone wolfSSL
20+
uses: actions/checkout@v4
21+
with:
22+
repository: wolfSSL/wolfssl
23+
path: wolfssl
24+
25+
- name: Clone wolfTPM
26+
uses: actions/checkout@v4
27+
with:
28+
repository: wolfSSL/wolftpm
29+
path: wolftpm
30+
31+
# Install dependencies
32+
- name: Install Dependencies
33+
run: |
34+
sudo apt-get update
35+
sudo apt-get install -y libtool automake autoconf
36+
sudo apt-get install -y build-essential git autoconf-archive \
37+
libcmocka-dev libssl-dev uthash-dev libglib2.0-dev \
38+
tpm2-tools openssh-client
39+
40+
# Clone, build, and start TPM Simulator
41+
- name: Clone and Build TPM Simulator
42+
run: |
43+
git clone https://github.com/kgoldman/ibmswtpm2
44+
cd ibmswtpm2/src
45+
make
46+
./tpm_server &
47+
sleep 2
48+
cd ../..
49+
50+
# Build and install wolfSSL
51+
- name: Build wolfSSL
52+
run: |
53+
cd wolfssl
54+
./autogen.sh
55+
./configure --enable-wolftpm --enable-wolfssh
56+
make
57+
sudo make install
58+
sudo ldconfig
59+
cd ..
60+
61+
# Build and install wolfTPM
62+
- name: Build wolfTPM
63+
run: |
64+
cd wolftpm
65+
./autogen.sh
66+
./configure --enable-swtpm
67+
make
68+
sudo make install
69+
sudo ldconfig
70+
cd ..
71+
72+
# Build wolfSSH
73+
- name: Build wolfSSH
74+
run: |
75+
cd wolfssh
76+
./autogen.sh
77+
./configure --enable-tpm
78+
make
79+
sudo make install
80+
sudo ldconfig
81+
cd ..
82+
83+
# Test TPM SSH Default Password
84+
- name: Test TPM SSH Default Password
85+
run: |
86+
# Generate key with default password
87+
cd wolftpm
88+
./examples/keygen/keygen keyblob1.bin -rsa -t -pem -eh
89+
cp key.pem key1.pem # Save the key for first test
90+
91+
# Convert key to SSH format
92+
ssh-keygen -f key1.pem -i -m PKCS8 > ../wolfssh/key1.ssh
93+
cd ..
94+
95+
# Start echoserver and wait for it to be ready
96+
cd wolfssh
97+
./examples/echoserver/echoserver -1 -s key1.ssh &
98+
echo "Echoserver started with PID: $!"
99+
sleep 2
100+
cd ..
101+
102+
# Test client connection with default password
103+
cd wolfssh
104+
./examples/client/client -i ../wolftpm/keyblob1.bin -u hansel -K ThisIsMyKeyAuth
105+
cd ..
106+
107+
# Test the TPM SSH Custom Password
108+
- name: Test TPM SSH Custom Password
109+
run: |
110+
# Test with custom password
111+
cd wolftpm
112+
./examples/keygen/keygen keyblob2.bin -rsa -t -pem -eh -auth=custompassword
113+
cp key.pem key2.pem # Save the key for second test
114+
115+
# Convert key to SSH format
116+
ssh-keygen -f key2.pem -i -m PKCS8 > ../wolfssh/key2.ssh
117+
cd ..
118+
119+
# Start echoserver and wait for it to be ready
120+
cd wolfssh
121+
./examples/echoserver/echoserver -1 -s key2.ssh &
122+
echo "Echoserver started with PID: $!"
123+
sleep 2
124+
cd ..
125+
126+
# Test with custom password
127+
cd wolfssh
128+
./examples/client/client -i ../wolftpm/keyblob2.bin -u hansel -K custompassword
129+
cd ..
130+
131+
# Archive artifacts for debugging
132+
- name: Archive test artifacts
133+
if: always()
134+
uses: actions/upload-artifact@v4
135+
with:
136+
name: test-artifacts
137+
path: |
138+
wolftpm/keyblob1.bin
139+
wolftpm/keyblob2.bin
140+
wolftpm/key1.pem
141+
wolftpm/key2.pem
142+
wolfssh/key1.ssh
143+
wolfssh/key2.ssh

‎README.md‎

Lines changed: 60 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,12 +34,13 @@ Additional build options for wolfSSL are located in
3434
[chapter two](https://www.wolfssl.com/docs/wolfssl-manual/ch2/).
3535
of the wolfSSH manual.
3636

37+
3738
building
3839
--------
3940

4041
From the wolfSSH source directory run:
4142

42-
$ ./autogen.sh
43+
$ ./autogen.sh (if cloned from GitHub)
4344
$ ./configure --with-wolfssl=[/usr/local]
4445
$ make
4546
$ make check
@@ -528,6 +529,64 @@ fred-cert.der would be:
528529

529530
$ ./examples/client/client -u fred -J ./keys/fred-cert.der -i ./keys/fred-key.der
530531

532+
TPM PUBLIC KEY AUTHENTICATION
533+
=============================
534+
535+
When using TPM for client side public key authentication wolfSSH has dependencies
536+
on wolfCrypt and wolfTPM. Youll also need to have a tpm simulator
537+
[wolfTPM](https://www.wolfssl.com/products/wolftpm/)
538+
[wolfSSL](https://www.wolfssl.com/products/wolfssl/)
539+
You'll need to build and configure wolfTPM, wolfSSL, and wolfSSH like so:
540+
541+
$ cd <wolfSSL, wolfTPM, wolfSSH>
542+
$ ./autogen.sh (if cloned from GitHub)
543+
$ <Configuration>
544+
$ make
545+
$ make check
546+
547+
<Configuration>
548+
wolfSSL
549+
$ ./configure --enable-wolftpm --enable-wolfssh
550+
wolfTPM
551+
$ ./configure --enable-swtpm
552+
wolfSSH
553+
$ ./configure --enable-tpm
554+
555+
For testing TPM with private rsa key you'll need to run the server from a TPM
556+
simulator like `ibmswtpm2`. This can be done as followed:
557+
558+
$ cd src
559+
$ ./tpm_server
560+
561+
Before starting the echoserver you need to run the keygen for keyblob
562+
using the endorsment key in wolfTPM with the following commands:
563+
Default password to `ThisIsMyKeyAuth`:
564+
565+
$ ./examples/keygen/keygen keyblob.bin -rsa -t -pem -eh
566+
567+
Custom password:
568+
569+
$ ./examples/keygen/keygen keyblob.bin -rsa -t -pem -eh -auth=<custompassword>
570+
571+
This will produce a key.pem TPM public key which needs to be converted the to
572+
the ssh-rsa BASE64 username format using this command:
573+
574+
$ ssh-keygen -f key.pem -i -m PKCS8 > ../wolfssh/key.ssh
575+
576+
The directory `examples` contains an echoserver that any client should
577+
be able to connect to. From wolfSSH open two terminal instances and run the
578+
server with the key.ssh file you created in the previous step:
579+
580+
$ ./examples/echoserver/echoserver -s key.ssh
581+
582+
From another terminal run the client with the keyblob. Using primary endorsement key
583+
If you used the default password for keygen you must specify the password:
584+
585+
$ ./examples/client/client -i ../wolfTPM/keyblob.bin -u hansel -K ThisIsMyKeyAuth
586+
587+
If you used a custom password for keygen you must specify the password you used:
588+
589+
$ ./examples/client/client -i ../wolfTPM/keyblob.bin -u hansel -K <custompassword>
531590

532591
WOLFSSH APPLICATIONS
533592
====================

‎configure.ac‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,16 @@ AC_ARG_ENABLE([certs],
171171
[AS_HELP_STRING([--enable-certs],[Enable X.509 cert support (default: disabled)])],
172172
[ENABLED_CERTS=$enableval],[ENABLED_CERTS=no])
173173

174+
# TPM 2.0 Support
175+
AC_ARG_ENABLE([tpm],
176+
[AS_HELP_STRING([--enable-tpm],[Enable TPM 2.0 support (default: disabled)])],
177+
[ENABLED_TPM=$enableval],[ENABLED_TPM=no])
178+
179+
if test "$ENABLED_TPM" != "no"
180+
then
181+
AC_CHECK_LIB([wolftpm],[wolfTPM2_Init],,[AC_MSG_ERROR([libwolftpm is required for ${PACKAGE}. It can be obtained from https://www.wolfssl.com/download.html/ .])])
182+
fi
183+
174184
# smallstack
175185
AC_ARG_ENABLE([smallstack],
176186
[AS_HELP_STRING([--enable-smallstack],[Enable small stack (default: disabled)])],
@@ -225,6 +235,8 @@ AS_IF([test "x$ENABLED_SSHD" = "xyes"],
225235
[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_SSHD"])
226236
AS_IF([test "x$ENABLED_SSHCLIENT" = "xyes"],
227237
[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_SSHCLIENT"])
238+
AS_IF([test "x$ENABLED_TPM" = "xyes"],
239+
[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_TPM"])
228240

229241
if test "$ENABLED_SSHD" = "yes"; then
230242
if test -n "$PAM_LIB"
@@ -279,6 +291,7 @@ AM_CONDITIONAL([BUILD_AGENT],[test "x$ENABLED_AGENT" = "xyes"])
279291
AM_CONDITIONAL([BUILD_SSHD],[test "x$ENABLED_SSHD" = "xyes"])
280292
AM_CONDITIONAL([BUILD_SSHCLIENT],[test "x$ENABLED_SSHCLIENT" = "xyes"])
281293
AM_CONDITIONAL([BUILD_CERTS],[test "x$ENABLED_CERTS" = "xyes"])
294+
AM_CONDITIONAL([BUILD_TPM],[test "x$ENABLED_TPM" = "xyes"])
282295

283296
AX_HARDEN_CC_COMPILER_FLAGS
284297

@@ -322,6 +335,7 @@ AS_ECHO([" * sftp: $ENABLED_SFTP"])
322335
AS_ECHO([" * sshd: $ENABLED_SSHD"])
323336
AS_ECHO([" * ssh client: $ENABLED_SSHCLIENT"])
324337
AS_ECHO([" * agent: $ENABLED_AGENT"])
338+
AS_ECHO([" * TPM 2.0 support: $ENABLED_TPM"])
325339
AS_ECHO([" * TCP/IP Forwarding: $ENABLED_FWD"])
326340
AS_ECHO([" * X.509 Certs: $ENABLED_CERTS"])
327341
AS_ECHO([" * Examples: $ENABLED_EXAMPLES"])

0 commit comments

Comments
 (0)