可以在非ssh应用程序中使用ssh密钥进行身份验证吗？

Question

I have an application consisting of client and server pieces, separated by the internet, where I control the server but need to authenticate client connections. The client connects to the server with a TCP connection and they then exchange JSON messages. The client is not a browser-based app, it is a headless node.js app running on a Linux server.

I would like to implement some authentication to the connection. My thought is that (similar to github) an authorized user (through a separate portal) can add their ssh public keys to a server-side database for the linux machines they will be running the clients on, and then I would like to authenticate using those ssh keys during TCP session establishment. Does this make sense? I am not familiar with using ssh key pairs for authentication for applications other than ssh, so I am not sure exactly how to implement this. Also, I am wondering if there is an alternate "best practice" or suggestions people might have for implementing authentication for an application like this. I want to protect the server and its resources against non-authorized client access. Any/all thoughts welcomed

Answer 1

You don't mention how your clients are being used - if it's all automated or if there are users manually starting the applications -, but technically, your solution would be a working (and probably not too uncommon) one: You would let the SSH client establish a tunnel for your TCP communication via the Internet and let your application connect to the local listening socket end of that tunnel. Thus, authentication (and, implicitly, encryption) would be handled by SSH, and apart from connecting to a different host (localhost), your application would be completely ignorant of that.