3 ms·
The SSH key stored in Krypton can be signed just like a local key-pair. The public key is stored in ~/.ssh/id_krypton.pub and SSH will look for the cert at ~/.s
by 4kevinking 8y ago
The SSH key stored in Krypton can be signed just like a local key-pair. The public key is stored in ~/.ssh/id_krypton.pub and SSH will look for the cert at ~/.ssh/id_krypton-cert.pub.
- tptacek 8y agoRight, but that's a long-lived durable SSH credential. Part of the point of modern SSH access management is not to have any of those anymore.
- 4kevinking 8y agoYes in this case the Krypton SSH key pair is long-lived, but the certificate issued to it by the server would be short-lived. How are users authenticating to this 2FA CA in the first place? Instead of using username/password and 2FA, users could authenticate to the CA using Krypton and then use the issued certificate for short-lived access. If Krypton using a long-lived SSH keypair is a non-starter, automatic key rotation could be added down the line (sort of like being forced to change your password but this would be automated).