3 ms·
You have to build a new ssh CA for each class of server. There's no mechanism for granting access by host name. This becomes unmanageable fast.
by true_tuna 9y ago
You have to build a new ssh CA for each class of server. There's no mechanism for granting access by host name.
This becomes unmanageable fast.
- blue6249 9y agoYou can represent that pretty easily with principals. Just make sure that each host has itself listed as a principal and generate keys that contain that same string. It's pretty common to have a set of increasingly general principals (I.e. Hostname, cluster, tier, root@everywhere).