5 ms·
> B) you'll have to upload new public SSH keys to all servers openssh supports a CA model, so .. you can set it up so that the servers trust the CA and the CA
by beagle3 9y ago
> B) you'll have to upload new public SSH keys to all servers
openssh supports a CA model, so .. you can set it up so that the servers trust the CA and the CA blesses the new key. Obviously, it just shifts the "but what if we lose the .." question from the user key to the CA key, but in many cases it makes a difference.
- Xylakant 9y agoYou could also have some sort of mechanism that updates the various servers (puppet, ...) or central authentication via LDAP. SSH logins are the least of my worries. Not being able to access my passwords would suck, though :)