4 ms·
He’s not talking about ssh keys, but ssh certs. As provided off the shelf by bless (Netflix), vault, step-ca, etc. they remove the burden of managing keys. For
by sjtindell 5y ago
He’s not talking about ssh keys, but ssh certs. As provided off the shelf by bless (Netflix), vault, step-ca, etc. they remove the burden of managing keys. For example you can give a single command a short-lived ssh cert that is only valid as long as the command takes to run and then expires.
- traceroute66 5y agoFor clarity, yes I did say certs. But even good old SSH keys are a million miles better than passwords. I guess I should have said "Public Key Authentication" since that would be more reflective of a desirable baseline SSHD configuration.