3 ms·

How are you managing your SSH keys to make <1HR rotation feasible?

• tptacek 9y ago
  With an SSH CA.
  • kasey_junk 9y ago
    Is there one of those you’d recommend?
    • skywhopper 9y ago
      Check out Hashicorp Vault (https://www.vaultproject.io/docs/secrets/ssh/signed-ssh-certificates.html https://www.vaultproject.io/docs/secrets/ssh/signed-ssh-cert...) for a general product (has lots of the features of AWS Secrets Manager as well), or Netflix BLESS (https://github.com/Netflix/bless https://github.com/Netflix/bless) for a very specific tool for just this.
    • euroclydon 9y ago
      I found these: https://www.digitalocean.com/community/tutorials/how-to-create-an-ssh-ca-to-validate-hosts-and-clients-with-ubuntu https://www.digitalocean.com/community/tutorials/how-to-crea... https://medium.com/uber-security-privacy/introducing-the-uber-ssh-certificate-authority-4f840839c5cc https://medium.com/uber-security-privacy/introducing-the-ube...