3 ms·
A couple of questions.. 1. Does every client have a copy of shh to interact with the secrets? Or are the secrets in the file served from a single centralized n
by ahnick 6y ago
A couple of questions..
1. Does every client have a copy of shh to interact with the secrets? Or are the secrets in the file served from a single centralized node?
2. What is your process of exchanging user keys with shh?
3. If someone leaves the company, what is the process you go through to change the secrets and rotate keys?
- hellcow 6y ago1. Every client (i.e. developer) has their own copy of shh but interacts with a shared .shh file in the project root. Secrets can be decrypted locally in memory then streamed to the remote servers over ssh. You could in theory run this on a server to help address your third point. 2. Exchanging public user keys is done via email when an employee starts, then added to the .shh file and committed in the repo. 3. You'd need to write a script for this, which probably involves `shh rm-user {email}`. There is no silver bullet here for changing secrets; since developers have access to secrets, any secret they had would need to be regenerated. `shh` makes no assumptions about how you deploy, what secrets you keep, or their formats.