3 ms·
> consider that long-lived SSH credentials are an anti-pattern. Exactly. Consider switching to auto-expiring SSH certificates. You can build your own certifica
by old-gregg 8y ago
> consider that long-lived SSH credentials are an anti-pattern.
Exactly. Consider switching to auto-expiring SSH certificates. You can build your own certificate management using a few open tools or switch to Teleport [1] which is 100% certificate based and doesn't even support keys. Disclaimer: I am one of the contributors.
[1] https://github.com/gravitational/teleport https://github.com/gravitational/teleport
- nerdponx 8y agoThanks for this. I will happily check out your tool, but what are some of the other solutions in this area?
- lvh 8y agoThere’s also BLESS and Hashicorp Vault. I have a penchant for Teleport.
- pvg 8y agoOh! Teleport does look pretty decent now that I've forced myself to look at it after going through this thread. I mention this mostly for the sort of people like me who read 'SSH CA' and their eyes roll into the backs of their heads and they start rocking and making saliva bubbles at thought of PAM modules and LDAP servers and so on. But this doesn't look nearly as bad. Go ssh implementation sounds like a nice ancillary bonus.
- thenewwazoo 8y agoIt’s probably pretty rotted by now but I wrote a version of this while I worked at Microsoft called ALTAR that’s backed by Azure services.