4 ms·

At work, we switched to Step CA [1] about 2 years ago. The workflow for our developers looks like: 1. `ssh client-hosts-01` 2. Browser window opens prompt

At work, we switched to Step CA [1] about 2 years ago. The workflow for our developers looks like: 1. `ssh client-hosts-01` 2. Browser window opens prompting for AzureAD login 3. SSH connection is accepted How is that simple, compared to `ssh -i .ssh/my-cert.rsa someone@destination --> connection is accepted, here's your prompt` ?

lucideer 4y ago
The former is discoverable: it doesn't require developers having ANY knowledge of command switches (no matter how basic) nor following a set of out-of-band instructions; the "how to" is included within the workflow.
- sokoloff 4y ago
  ssh-add (once per session) gives users back that incredible convenience. If you wanted to rotate certs, you’d have to add each new one, of course.
- the8472 4y ago
  The server could display that info when a user tries to log in via interactive authentication.
Aeolun 4y ago
This is simple because it doesn’t require you to take any specific actions to make new/different hosts accessible. If you deactivate someone in AD, poof, all their access is magically gone, instead of having to remove their public key from every server.
mynameisvlad 4y ago
It’s the exact same command as a regular SSH prompt and it generates and uses the cert. that seems very simple. Your command is disingenuous in that it only works if the certificate has already been issued to you. If you were to include issuance, your command would very much turn non-simple.
- dijit 4y ago
  If I'm reading it right then there's a non-insignificant amount of setup necessary for the proposed approach anyway, generating and sharing a public key is much easier even for the customer/client.
shrx 4y ago
What if you're ssh-ing from a headless client, like a raspberry pi or a VPS?
- WastingMyTime89 4y ago
  Then it doesn’t work but their developers are ssh-ing from their work laptops so it doesn’t matter. Something doesn’t have to be a solution for all use cases to be a good solution.

lucideer 4y ago

The former is discoverable: it doesn't require developers having ANY knowledge of command switches (no matter how basic) nor following a set of out-of-band instructions; the "how to" is included within the workflow.

sokoloff 4y ago
ssh-add (once per session) gives users back that incredible convenience. If you wanted to rotate certs, you’d have to add each new one, of course.
the8472 4y ago
The server could display that info when a user tries to log in via interactive authentication.

Aeolun 4y ago

This is simple because it doesn’t require you to take any specific actions to make new/different hosts accessible. If you deactivate someone in AD, poof, all their access is magically gone, instead of having to remove their public key from every server.

mynameisvlad 4y ago

It’s the exact same command as a regular SSH prompt and it generates and uses the cert. that seems very simple. Your command is disingenuous in that it only works if the certificate has already been issued to you. If you were to include issuance, your command would very much turn non-simple.

dijit 4y ago
If I'm reading it right then there's a non-insignificant amount of setup necessary for the proposed approach anyway, generating and sharing a public key is much easier even for the customer/client.

shrx 4y ago

What if you're ssh-ing from a headless client, like a raspberry pi or a VPS?

WastingMyTime89 4y ago
Then it doesn’t work but their developers are ssh-ing from their work laptops so it doesn’t matter. Something doesn’t have to be a solution for all use cases to be a good solution.