21–30 of 156 posts
Auth is handled in a browser e.g. by Google, and the CA will sign a key and return a cert with a valid token.
But certificates - no. I don't see the need for this in my home environment. In my opinion it only makes sense if you have a PKI, in which case you already have the whole CA scenario covered.
I found these SSH features while studying the ssh-keygen(1) man page. I don't use extra tools aside what SSH ships.
We looked into them once at work for our "conventional" SSH infrastructure, but immediately rammed into the wall that a certificate can sign a key, but you can't have a full PKI infrastructure like SSL where certs can sign certs that can sign keys. Without the ability to delegate, the logistics of needing to create an absolutely centralized authority to do the useful things we wanted to do within the organization rai…
To your point about clouds making it more difficult in the future, it's becoming more challenging to scale the CA across auto scaling groups with dynamic IPs and where you can't control TXT records. We've found that SSH keys are very flexible, and we simply needed a centralized management point (which we have now), but with decentralized operation in case anything is offline along the way. Also, it's very important to us to be able to kill active sessions globally when a user is removed, and there doesn't seem to be any other tools that do that except Userify.
I've used public-key basically forever. I have wanted to go that step further and implement certificates for a good few years now, I absolutely see the value, no question about it (i.e. no more out of date authorized_keys files, no need to even install authorized_keys files in the first place, the list goes on). I wish YubiKeys were more flexible in allowing SSH certificates to be hosted on them (currently can only h…
As an alternative, you might consider using an ed25519-sk ssh key so you can use your YubiKey as a second factor during authentication. I've got my keys loaded up in the SSH agent by KeepassXC when I open my database and can log in to a box just by pressing my YubiKey. No keys on disk, no passwords to remember (except your Keepass master key ofcourse).
Every approach has strengths and weaknesses, the password-less method is convenient... but is the number one target for worms/bots. =)
I store my authorized_keys in DNS TXT records, that are DNSSEC signed, with a validating resolver on the box. I then just use "/usr/bin/hesinfo %u ssh" as my AuthorizedKeysCommand in OpenSSH. I wrote a little tool that allowed you to "#include" other DNS records etc, but "hesinfo" is generally easily installable/available so it's just easier.