2 ms·
On a related topic, what is the current best practice for avoiding TOFU for cloud providers? Sure, SSH certificates provide that for normal users, but how does
by rauhl 7y ago
On a related topic, what is the current best practice for avoiding TOFU for cloud providers? Sure, SSH certificates provide that for normal users, but how does the SSH CA know — ideally in an automated fashion — what that public key is? An admin can SSH into the machine to check it, but then he has to trust the key he sees. He could access it via the console, but that is a manual process. All the other approaches I can think of involve generating at least one key outside the machine which uses it, which seems like a poor solution.
- wraithm112 7y agoAt least on AWS, you can parse the System Console Output. On the first boot, the box dumps its pub keys there. We have a tool that parses the output: https://github.com/bitnomial/aws-ec2-knownhosts https://github.com/bitnomial/aws-ec2-knownhosts Right now, this is pretty specific to our use of it, specifically our use with Terraform EC2 instances. We'd happily suggest changes to make it more generic. But you can see the parsing logic there.