[droid151]

I have recently found a neat alternative for the classic username/password login scheme and that was the use of x.509 client certificates as a mean to establish identity. Of course it's not really user friendly, but if you have a website that you wanna hide, or have an admin section and want to remove the noise generated by failed login attempts this could come in handy.
Basically you become your own CA and issue client certificate that will be used similarly how ssh keys are used, but instead of terminal you will import it in browser/app to which you wanna grant access. You can also put additional data in the certificate itself, for example user role.

So I played around with it for a while to test how it work and now I'm gonna put it here, if someone ever needs it.
1st you need to to establish yourself as a Certficate Authority

Code:

openssl genrsa \   -des3 \   -out ca.key \   -passout pass:CA_PASSWORD \   4096 openssl req \   -new \   -x509 \   -days 365 \   -key ca.key \   -out ca.crt \   -passin pass:CA_PASSWORD

Which will leave you with two files ca.key and ca.crt. We can use them to issue the client certificate.
To do so first we need to create csr (certificate signing request)

Code:

openssl genrsa -des3 -out client.key 4096 openssl req -new -key client.key -out client.csr

This is also the part where you can insert user role data in the cert. If you want to do that then substitute the last line of the code (openssl req) with this one

Code:

openssl req -nodes -new -key client.key -out client.csr \     -subj "/C=UK/ST=/L=Oxford/O=Temple of the Skyqueen/CN=narki@disroot.org" -config openssl.conf

So now that we have created csr we can issue the client certificate

Code:

openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt

Some application or browsers may complain if client certificate and client key are not merged in single file, so in that case you can convert them to single .p12 file

Code:

openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12

On server side (nginx) add  to server block

Code:

ssl_client_certificate /path/to/ca.crt; ssl_verify_client on; error_page 495 496 497 http://public-part-of-the-site.com; #I don't use apache but I think it might have different error codes

Now if non-certified user navigates to that protected part of the website they will bi redirected back to the public part of the site.

We could also leave ssl_verify_client on optional and in that case redirecting would be done like this

Code:

# Works only if ssl_verify_client is set # on "optional" if ($ssl_client_verify != SUCCESS) {     return 403; #return 303 http://public-part-of-the-site.com; }

Like I said, it's not something that could be used with a large amount of people, but if you need to grant access to a few of them, or only on some specific machines it might be a viable alternative.

EDIT: also certificates are harder to steal then password