3 ms·
Kerberos + ssh is amazing. I don't know why more people aren't aware of this holy grail setup.
by feld 10y ago
Kerberos + ssh is amazing. I don't know why more people aren't aware of this holy grail setup.
- alexk 9y agothere are a couple of nice SSH setups you can achieve with RADIUS and our friends at https://www.foxpass.com/ https://www.foxpass.com/ Vault also has SSH backends that you could find useful
- SEJeff 9y agoMy thoughts exactly, and it has years of production battle hardening + crypto validation.
- edgan 9y agoKerberos is really complicated. I am currently setting up LDAP, and have it storing SSH keys. Which is a far simpler setup.
- feld 9y agoWe do both. Ssh keys are the backup if there's ever a kerberos outage. Also make sure to deploy the ssh keys somewhere the users can't write for extra security. Don't allow them to control their own authorized_keys files! :-)