11–20 of 20 posts
2. What user's 'authorized_keys' would "kr add" write with a team? I don't want a team to share a single user.... luxury problem, but hey.
3. Make it possible to try local keys before krypton
4. Great work!
How does this work with modern SSH access management? If you were talking to an organization about maybe adopting this, and they told you they were planning in the medium term to move to a system where developers 2FA-authed to an auth server and got issued time-limited SSH certificates, where would your thing fit in?
... Or are you speaking about some niche ssh key usage paradigm such as a apart of a custom keyring authorization access system for short term client usage to a service.
thanks.
How does this work with modern SSH access management? If you were talking to an organization about maybe adopting this, and they told you they were planning in the medium term to move to a system where developers 2FA-authed to an auth server and got issued time-limited SSH certificates, where would your thing fit in?
Pardon my ignorance, what is "modern ssh access management" ... Is there a toggle on an OS to enforce this lease-mode mode ssh, like say on Ubuntu 18.04 LTS. ... Or are you speaking about some niche ssh key usage paradigm such as a apart of a custom keyring authorization access system for short term client usage to a service. thanks.
1. All team actions should be prefixed under "kr team", right now i don't know what happens if i run "kr add" if i only want to add myself to a server, ie outside my team. 2. What user's 'authorized_keys' would "kr add" write with a team? I don't want a team to share a single user.... luxury problem, but hey. 3. Make it possible to try local keys before krypton 4. Great work!
`kr add` will add your public key if no members are specified. The user being modified is whichever is being logged into. So if you have an ssh alias "bastion" that specifies user "jump" in your SSH config, `kr add bastion` adds your public key to user "jump". Just like when SSHing into a server, you can override the default user in the form `kr add user@bastion`.
This is only the first iteration of `kr add`, and we will be adding more advanced access control in the near future, including authenticating as one user but modifying another.
Totally agree with 3., we'll add this to our roadmap.
Thanks!
1. All team actions should be prefixed under "kr team", right now i don't know what happens if i run "kr add" if i only want to add myself to a server, ie outside my team. 2. What user's 'authorized_keys' would "kr add" write with a team? I don't want a team to share a single user.... luxury problem, but hey. 3. Make it possible to try local keys before krypton 4. Great work!
Point taken, the intention is to make each command more succinct and we overloaded the functionality of `kr add` to do so. `kr add` will add your public key if no members are specified. The user being modified is whichever is being logged into. So if you have an ssh alias "bastion" that specifies user "jump" in your SSH config, `kr add bastion` adds your public key to user "jump". Just like when SSHing into a server,…
Earlier quoted context omitted.
Pardon my ignorance, what is "modern ssh access management" ... Is there a toggle on an OS to enforce this lease-mode mode ssh, like say on Ubuntu 18.04 LTS. ... Or are you speaking about some niche ssh key usage paradigm such as a apart of a custom keyring authorization access system for short term client usage to a service. thanks.
The Google search you want to do is "SSH certificate authority". There's no one thing; it's just a trend in high-end SSH management.
Contrast to my personal Android phone I carry everywhere - so how is that more secure for an SSH key to live on?
Persuade me or at least tell me where I misread the webpage :)
So I have a Linux laptop with full disk encryption that only gets used for work stuff and lives in the office 5-6 out of 7 days. If I move it, I'm paying attention. Contrast to my personal Android phone I carry everywhere - so how is that more secure for an SSH key to live on? Persuade me or at least tell me where I misread the webpage :)
It's kinda like yubikey vs having a PGP key.
So I really wanted to use this for our team but hit a few problems. This seems to run on AWS and so does most of our systems if this does not work and with no way to export the private keys I assume there is no way to SSH. Also it seems to use the same key for team stuff as personal stuff showing personal git commits in the audit log.
There isn't a good division between personal and work use yet -- this is something that's coming (i.e. multiple teams/keys support).