4 ms·
How do they handle revocation? The problem I had with this approach in the past was no CRL support.
by lox 10y ago
How do they handle revocation? The problem I had with this approach in the past was no CRL support.
- mfdutra 10y agoWe can use RevokedKeys for that, but in fact we normally issue short-lived certificates. If we ever have a mass certificate leak, we'll just rotate the entire CA.
- mfdutra 10y agoAlso, we bind certificates to the hosts that requested them. If a certificate and its private key move somewhere else, they will be useless. ssh-keygen -O source-address=1.2.3.4...
- lox 10y agoInteresting, so I'm assuming this wouldn't work for staff that roam with laptops?
- mfdutra 10y agoWe only do that in bastion servers. It would be a bit trickier with laptops, but doable I guess.
- lox 10y agoMakes sense. I missed that section, much clearer now, thanks. Any plans to release more details on how the bastion hosts are configured? Seems like that would be the complex bit to get right.
- mfdutra 10y agoAbsolutely nothing special about them. They trust the same LDAP/Kerberos infra the laptops are part of. We have two-factor authentication, which is pretty simple with PAM. And they're only accessible if you are in our corporate network.
- tptacek 10y agoWith RevokedKeys. It looks like Facebook also uses short-lifespan certificates.
- lox 10y agoSo staff that leave have 1 week of access to production systems?
- tptacek 10y agoAgain: you can revoke keys.
- lox 10y agoI get that, but you need to update the revocation list on every single server. At which point you've just undone the benefit of not having to manage `authorized_keys` on each server.
- brazzledazzle 10y agoSure, but wouldn't the complexity of managing distributed authorized_keys be significantly higher than propagating revokedkeys across a fleet of servers? You get the benefit of central management/administration with the benefit of distributed ssh keys. It's almost the best of both worlds.
- lox 10y agoIt doesn't seem like it's more work, although you are right in that it's probably more user friendly as you don't have to wait for keys to propagate to various servers before you can login. We've previously used a cron script to pick up authorized_keys from a centrally published source, I guess that same infrastructure just moves to the CRL.
- brazzledazzle 10y ago