4 ms·
We can use RevokedKeys for that, but in fact we normally issue short-lived certificates. If we ever have a mass certificate leak, we'll just rotate the entire C
by mfdutra 10y ago
We can use RevokedKeys for that, but in fact we normally issue short-lived certificates. If we ever have a mass certificate leak, we'll just rotate the entire CA.
- mfdutra 10y agoAlso, we bind certificates to the hosts that requested them. If a certificate and its private key move somewhere else, they will be useless. ssh-keygen -O source-address=1.2.3.4...
- lox 10y agoInteresting, so I'm assuming this wouldn't work for staff that roam with laptops?
- mfdutra 10y agoWe only do that in bastion servers. It would be a bit trickier with laptops, but doable I guess.
- lox 10y agoMakes sense. I missed that section, much clearer now, thanks. Any plans to release more details on how the bastion hosts are configured? Seems like that would be the complex bit to get right.
- mfdutra 10y agoAbsolutely nothing special about them. They trust the same LDAP/Kerberos infra the laptops are part of. We have two-factor authentication, which is pretty simple with PAM. And they're only accessible if you are in our corporate network.