// the take
HIBA extends OpenSSH certificate authentication with a host-identity/grant model so you can authorize users against pools of servers without maintaining per-host authorized_users files. It's for teams running their own SSH CA who want fine-grained, offline-capable access control without standing up something like Teleport or Boundary.
Decisions happen entirely on the target host by comparing certificate extensions, so there's no external authz service to call or go down during an SSH session — genuinely useful for break-glass/last-resort access. It builds on existing OpenSSH primitives (AuthorizedPrincipalsCommand, cert extensions) rather than inventing a new daemon or protocol, so the attack surface and ops model stay familiar. The grant/identity matching semantics (missing field = wildcard) are simple enough to reason about and documented precisely in the PROTOCOL files rather than left to README prose.
Grant-level revocation isn't implemented — the README admits this and tells you to rely on short-lived certs or full certificate revocation instead, which pushes real operational burden onto your CA's cert-issuance pipeline. The library is explicitly not thread-safe and says locking is the caller's problem, which is an easy way to get subtle corruption bugs if you embed libhiba in a multi-threaded CA service. It depends on OpenSSH-specific tokens added in 7.4+, so you're locked to OpenSSH's cert format and can't use this with other SSH implementations. At 390 stars and a C codebase with no packaged CA tooling (CA.md is explicitly 'a basic example'), you're building and maintaining your own CA integration, not adopting a turnkey system.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →