This repo provides a container setup for use with [docker|podman]-compose to demonstrate different SSH authentication mechanisms.
- password
- public key
- certificates
- OpenPubKey
see also https://fosdem.org/2026/schedule/event/ST9D39-ssh-logins-cert-vs-opkssh/
git clone https://github.com/CLIP-HPC/ssh_lab
podman-compose up
./init/setup-idm.sh
./init/setup-certs.sh
./fixup.sh
# now all containers should be running, and services healthy (this bootstrap process is a bit dirty and needs cleanup)
# run the demos, each demo will print instructions for all the steps and reset the container/user state
./demo1_passwd.sh
./demo2_pubkey.sh
./demo3_cert.sh
./demo4_opkssh.sh
In its current form, the bootstrap process is quite dirty, due to some circular dependencies between the CA and kanidm. Kanidm cannot be easily bootstrapped with various secrets and credentials (oauth and user creds)