3 ms·
SSH certificates avoid this issue and are used in real life. We make them with hashicorp vault, it works well and is really convenient.
by forty 6y ago
SSH certificates avoid this issue and are used in real life. We make them with hashicorp vault, it works well and is really convenient.
- GordonS 6y agoHuh, I had no idea there was even such a thing as SSH certificates! Presuming you mean X.509 certificates, is this part of the standard spec (e.g. should work with OpenSSH etc)? Do you know if it works with PuTTY?
- jbreiding 6y agoHere is a guide I've found useful in the subject, https://engineering.fb.com/security/scalable-and-secure-access-with-ssh/ https://engineering.fb.com/security/scalable-and-secure-acce....
- TimWolla 6y agoThey are not based on X.509. I recommend taking a look at the CERTIFICATES section of the ssh-keygen man page, because I am unable to find a good reference on the web right now.
- MaxBarraclough 6y agoHave to admit I'm not very familiar with SSH certs. I'm generally just spinning up a fresh Ubuntu instance on EC2, so I have an entirely 'vanilla' SSH set-up. Small scale, so I don't especially mind the ritual of verifying the fingerprint. It's annoying though that it takes a few minutes for the EC2 system-log to be populated with the 'true value' of the fingerprint.