3 ms·
Not disagreeing with you, but I can think of two reasons why you might use distinct keys from the one client (and use ssh config to enforce the separation) * Y
by enasterosophes 4y ago
Not disagreeing with you, but I can think of two reasons why you might use distinct keys from the one client (and use ssh config to enforce the separation)
* You want to present different identities to the world and don't want them being conflated, eg separate your github hobby projects from your employer organization.
* You are using ssh certificate authentication, which isn't supported by GitHub yet, but you might be using it for other things, and GitHub should hopefully support it in the future. Since this relies on the name of the cert file matching the private key filename (eg id_ed25519-cert.pub corresponding to id_ed25519), you can't afaik have different certs active for the one key. Personally, I deal with this by simply having different private keys for different purposes, to avoid cert collision.
- psanford 4y agogithub does support ssh certs, but only for its enterprise offering.
- enasterosophes 4y agoInteresting, thanks. I had a feeling the support was limited to host certs.
- chasil 4y agoIn any case, "sed -i" can be used to add new keys, and remove old ones, from a set of ~/.ssh/authorized_keys files on a collection of hosts. It is good to be aware of the contents of these allowed credentials, and sweep unused entries. This article has a script that automates the procedure: https://www.linuxjournal.com/content/ssh-key-rotation-posix-shell-sunset-nears-elderly-keys https://www.linuxjournal.com/content/ssh-key-rotation-posix-...