Email or username:

Password:

Forgot your password?
Top-level
Ramin Honary

@alex_02 @nixCraft I't not gonna lie, it never occurred to me to use certificates. I mean, don't you need to create your own CA and install it onto all of your machines, unless you want to go through the trouble of getting it signed by Lets Encrypt?

And it is just so easy to do ssh-copy-id, especially if you only need to network like 3 or 4 machines together.

9 comments
DELETED

@ramin_hal9001 @nixCraft Security vs Convenience will always bite us in the ass. ;-;

Found a good article on ssh certificates:

goteleport.com/blog/how-to-con

Thomas H Jones II

@astraleureka @ramin_hal9001 @alex_02 @nixCraft

No, but you *can* configure newer SSH daemons to use x509s for authentication.

apgarcia

@ferricoxide @astraleureka @ramin_hal9001 @alex_02 @nixCraft newer ssh daemons? the globus toolkit was using x509 certs for authentication in the early 2000s...

Thomas H Jones II

@apgarcia @astraleureka @ramin_hal9001 @alex_02 @nixCraft

"Newer" is relative. Not every OS vendor (*cough* Red Hat *cough*) is quick to update. Still not sure if OpenSSH (particularly the versions used by conservative distros like Red Hat and its clones) directly supports x509 or if they just support the more stripped-down SSH certificates.

Thomas H Jones II

@ramin_hal9001 @alex_02 @nixCraft

Problem with copying keys about - especially in a large scale environment – is the "how do you make sure ≀EX_EMPLOYEE>'s keys are all removed everywhere".

Fuzzysteve

@ferricoxide @ramin_hal9001 @alex_02 @nixCraft By pushing the keys via your centralized authentication system? So they don't exist on the box themselves. and that the centralized account is also removed?
Of course, then you also need something which is going to be checking every server to make sure no rogue accounts have been created.

Thomas H Jones II

@fuzzysteve @ramin_hal9001 @alex_02 @nixCraft

Yes. In general, offloading to a third-party key-auth mechanism is going to avoid the "stale keys" problem.

Similarly, combination of configuring SSH to ignore locally-staged keys, configuring sudo and/or SELinux to prevent random users from creating local accounts and having good monitoring/alerting in place goes a long way towards solving the "rogue accounts" problem.

Go Up