2 ms·
You can distribute a key revocation list along with your regular configuration management. The key revocation list can be generated and maintained via ssh-keyge
by blueflow 5y ago
You can distribute a key revocation list along with your regular configuration management. The key revocation list can be generated and maintained via ssh-keygen.
I used to have a central location with an revocation list. All servers had a cronjob fetching it.
- camtarn 5y agoAnd that's pretty much the exact same infrastructure you'd need for distributing authorized_keys. Instant revocation seems to be a giant hole in this article's argument which isn't addressed at all. If you fire somebody partway through the work day, end-of-day cert expiry is not good enough to prevent compromises.