4 ms·
Pulling your SSH keys from Github to your authorized_keys file is a terrible idea, even with 2FA enabled on the GitHub side. You're trusting Github to manage a
by chrissnell 9y ago
Pulling your SSH keys from Github to your authorized_keys file is a terrible idea, even with 2FA enabled on the GitHub side. You're trusting Github to manage access to your home network and all of its SSH-able machines!
- StavrosK 9y agoTrue, but it would be pretty nifty if there were a thing that would download an authorized_keys file, check the PGP signature against a key I had specified, and copy the file to the SSH dir if the signature was okay.
- craftyguy 9y agoUh, why couldn't you just sign your authorized_keys file and post it somewhere public? Then you just literally download, verify signature, and 'import' it (overwrite or append to existing file).
- StavrosK 9y agoYes, that's exactly what I said "would be nifty" above. I meant a client-side bash script or similar.
- craftyguy 9y agoHere's a start: https://bpaste.net/show/049673c13cbf https://bpaste.net/show/049673c13cbf You can clear sign an authorized_keys file with "gpg --clearsign <authorized_keys>", then just pass the resulting *.asc file to this script. It will verify the signature and 'import' it by copying it to ~/.ssh.
- StavrosK 9y agoLooks good, thanks! Good way to update all my machines' SSH keys.
- ptman 9y agoWhat about something like monkeysphere? http://web.monkeysphere.info/getting-started-ssh/ http://web.monkeysphere.info/getting-started-ssh/