4 ms·

You could use something like ansible for the management of keys. Or you could centralize your authentication, which would probably be a lot more sane.

• jethro_tell 11y ago
  Even with central management, I don't know that I want to have 2500 keys floating around even if I have a management stack in place. That seems like an attack vector all in its own. Changing a key every other day on a 90 day rotation with 50 boxes. And fifty boxes isn't even that much. That's like 2 racks. Even with config management this won't scale past about 2 or 3 people and 10-20 boxes. Central auth is an option I guess but I think the better way to go would be a 2 factor with the key and hotp.
  • xorcist 11y ago
    It's not that bad, it's part of the user data and should be provisioned the same way. OpenSSH can also be used in a PKI fashion, where you use certificates instead of known_hosts and authorized_keys records. It's quite all right, but it comes with the same problems a full PKI does as you need to keep track of when the certificates expire. You also need a way to distribute CRLs so you still need configuration management.
    • jethro_tell 11y ago
      The suggestion was not PKI though. I'd be happy with that. I already have a PKI in place. The suggestion was for a 1 key per box.