4 ms·

How is ssh certificates the next level up? Feels like the added complexity of using this is might be worthwhile for larger orgs but maybe not smaller shops

• kempbellt 7y ago
  I second this perspective. It might be useful for a larger org, but for my use case and that of my team, I don't see much value-add, and the added complexity would likely make managing this system more difficult than it is worth. I've also never had an issue with key management, like the article suggests is common. Maybe I'm not the target audience though.
• yjftsjthsd-h 7y ago
  Is one person a small enough shop? ;) I found it useful for personal systems because it meant that I didn't need to verify keys (user keys and host keys) for every server/laptop combination.
• old-gregg 7y ago
  Disclaimer: I work at Gravitational, one of our engineers is the author of the article. The added complexity is indeed significant, that's why we built Teleport [1] which is much, much simpler open source alternative to OpenSSH for such use case (the blog post does not mention Teleport because it was written for OpenSSH users). But generally, certificates have a number of advantages: they expire quickly (you can have one-shot certs), they contain your full name, email address, or whatever you wish via metadata, this allows to implement RBAC on top of SSH. They address "trust on first use" issue, and they're easy to synchronize with other protocols, i.e. you can have the same CA issue certificates for both Kubernetes and SSH (with identical RBAC rules). When implemented properly, they're actually easier to use. The whole world uses certificates to do online banking and shopping, there's no reason not to have the same seamless experience for SSH. [1] https://gravitational.com/teleport https://gravitational.com/teleport
  • Gaelan 7y ago
    btw, huge props for not mentioning teleport in that blog post. So many companies have blog posts that masquerade as tutorials for "how to do X" but then change halfway through to "OOOORRRR you can not do all that complicated stuff and just buy our product instead," which feels pretty scummy. Thanks for taking the high road.
    • old-gregg 7y ago
      Thank you, Gaelan! I am not the author, but will pass this along to Gus.