There's a neat Python application, ssh_ldap_pubkey, that not only retrieves the user's pubkeys (e.g. can be called by SSH) but also allows users to manipulate t

There's a neat Python application, ssh_ldap_pubkey, that not only retrieves the user's pubkeys (e.g. can be called by SSH) but also allows users to manipulate them (add/delete). So end users generate the keys and push them to the LDAP cluster themselves. The backend servers then validate SSH keys against the LDAP servers instead of locally, so it's a perfectly logical extension of existing LDAP functionality. It's not specifically Teleport I distrust, it's most cloud-based software due to its often-woeful attention to security. Also, if we suffer a major internet outage and my systems lose connection, it shouldn't stop me SSH'ing into them. So long as my LDAP machines, on the same LAN, are up, I can get in. I also dislike paying for something we could build ourselves for little-to-moderate effort :)