3 ms·
Probably the most simple way to avoid TOFU is to just throw in a simple 1-2 liner into your server creation cloud-init / script / etc fingerprint the host key
by okdjnfweonfe 5y ago
Probably the most simple way to avoid TOFU is to just throw in a simple 1-2 liner into your server creation cloud-init / script / etc
fingerprint the host key -> send an SMS and email of it to you via some APIs -> if they match, then feel free to paste it in during TOFU
- jeroenhd 5y agoIf you have a server creation cloud script, you could use an SSH CA to set up server authentication. It requires some extra work (namely finding a way to automatically sign a host key) but it does allow you to avoid TOFU for your entire team rather than just for yourself. Coupled with a second CA for authentication, SSH certificates can be a very powerful way to do SSH server management. Sending emails or texts is easy, but checking them each time you log in from a new device is cumbersome. I'm too lazy to do the latter and prefer to put in work to set up my complex setup instead, but of course your mileage may vary.
- deleted 5y ago[deleted]