Page MenuHomePhabricator

Deactivate SSH keys instead of destroying them completely

Authored by epriestley on May 18 2016, 4:46 PM.
Referenced Files
Unknown Object (File)
Sat, Feb 4, 4:02 PM
Unknown Object (File)
Sat, Feb 4, 4:07 AM
Unknown Object (File)
Sun, Jan 22, 3:35 AM
Unknown Object (File)
Sun, Jan 15, 10:20 AM
Unknown Object (File)
Sun, Jan 15, 10:20 AM
Unknown Object (File)
Dec 30 2022, 11:08 AM
Unknown Object (File)
Dec 26 2022, 9:36 PM
Unknown Object (File)
Nov 23 2022, 2:50 AM



Ref T10917. Currently, when you delete an SSH key, we really truly delete it forever.

This isn't very consistent with other applications, but we built this stuff a long time ago before we were as rigorous about retaining data and making it auditable.

In partiular, destroying data isn't good for auditing after security issues, since it means we can't show you logs of any changes an attacker might have made to your keys.

To prepare to improve this, stop destoying data. This will allow later changes to become transaction-oriented and show normal transaction logs.

The tricky part here is that we have a UNIQUE KEY on the public key part of the key.

Instead, I changed this to UNIQUE (key, isActive), where isActive is a nullable boolean column. This works because MySQL does not enforce "unique" if part of the key is NULL.

So you can't have two rows with ("A", 1), but you can have as many rows as you want with ("A", null). This lets us keep the "each key may only be active for one user/object" rule without requiring us to delete any data.

Test Plan
  • Ran schema changes.
  • Viewed public keys.
  • Tried to add a duplicate key, got rejected (already associated with another object).
  • Deleted SSH key.
  • Verified that the key was no longer actually deleted from the database, just marked inactive (in future changes, I'll update the UI to be more clear about this).
  • Uploaded a new copy of the same public key, worked fine (no duplicate key rejection).
  • Tried to upload yet another copy, got rejected.
  • Generated a new keypair.
  • Tried to upload a duplicate to an Almanac device, got rejected.
  • Generated a new pair for a device.
  • Trusted a device key.
  • Untrusted a device key.
  • "Deleted" a device key.
  • Tried to trust a deleted device key, got "inactive" message.
  • Ran bin/ssh-auth, got good output with unique keys.
  • Ran cat ~/.ssh/ | ./bin/ssh-auth-key, got good output with one key.
  • Used auth.querypublickeys Conduit method to query keys, got good active keys.

Diff Detail

rP Phabricator
Lint Passed
Tests Passed
Build Status
Buildable 12257
Build 15488: Run Core Tests
Build 15487: arc lint + arc unit

Event Timeline

epriestley retitled this revision from to Deactivate SSH keys instead of destroying them completely.
epriestley updated this object.
epriestley edited the test plan for this revision. (Show Details)
epriestley added a reviewer: chad.
chad edited edge metadata.
This revision is now accepted and ready to land.May 18 2016, 9:32 PM
This revision was automatically updated to reflect the committed changes.