4 ms·
How do you manage what servers clients trust? I've seen a few SSH CA projects for signing user certs, but not for the server side certificates. When you're ru
by mcpherrinm 10y ago
How do you manage what servers clients trust?
I've seen a few SSH CA projects for signing user certs, but not for the server side certificates.
When you're running containers, if they're spawned frequently, that can mean a significant amount of known_hosts file churning. It sounds like everyone funnels through a small set of bastions, so you'd only need to update them there, but I'm wondering if anyone else uses an SSH CA to solve that side of the equation?
All the ingredients needed are in `ssh-keygen`, but that doesn't feel super awesome to me.
Solving server identity is why I built https://github.com/square/sharkey https://github.com/square/sharkey
- knorker 10y agoYou've not seen that? It's HostCertificate in sshd_config. Then in known_hosts: @cert-authority *.example.com ssh-rsa AAAAB… https://www.digitalocean.com/community/tutorials/how-to-create-an-ssh-ca-to-validate-hosts-and-clients-with-ubuntu https://www.digitalocean.com/community/tutorials/how-to-crea... Edit: Oh, you mean for making them more short lived.
- mcpherrinm 10y agoYou can trust a CA easily enough. So do you just glob some shell scripts around ssh-keygen? Short-lived is one solution to limiting their lifetime: the other is to use a CRL format. Either way, you need software to manage the issuance and later revocation. I suppose you could build this into your host imaging profile, or use config management software. I'm just interested in what people do.