4 ms·
I've always thought of SSH host certificates as somewhat of an abomination and maybe I am in the minority because the better solution was always about making SS
by OrvalWintermute 4y ago
I've always thought of SSH host certificates as somewhat of an abomination and maybe I am in the minority because the better solution was always about making SSH speak x509 properly
https://roumenpetrov.info/secsh/index.html https://roumenpetrov.info/secsh/index.html
Roumen has been regularly updating this for a pretty long time now.
- vaporary 4y agoSSH host certificates as somewhat of an abomination Many would say x509 is the real abomination.
- OrvalWintermute 4y agoI might not disagree with you there. However, for all its warts, x509 due to hardware implementations, seems a great deal more secure than sitting on the FS SSH host certificates.
- fmajid 4y agoOpenSSH supports FIDO keys since 8.2p1 and has supported smart cards via GPG longer.
- Reitet00 4y agoYeah. Actually ssh agent speaks PKCS#11 (both client and server) so it's possible to interface with the hardware token quite easily. I'm using that to store my client key in TPM for example.
- aorth 4y agoCan't view this site on mobile. Constantly refreshing and redirecting to itself on Firefox / Android...