3 ms·
More layers, more abstractions, more divergence, more interoperability problems, more vulnerabilities. There's already mature CA support in OpenSSH https://de
by 1letterunixname 4y ago
More layers, more abstractions, more divergence, more interoperability problems, more vulnerabilities.
There's already mature CA support in OpenSSH
https://dev.to/gvelrajan/how-to-configure-and-setup-ssh-certificates-for-ssh-authentication-b52 https://dev.to/gvelrajan/how-to-configure-and-setup-ssh-cert...
And even OpenSSH 8.2+ supports FIDO2 built-in.
Can add TOTP, FIDO2/u2f, ldap, or kerb with pam also.
- hsbauauvhabzb 4y agoWhat’s the value of a CA in openSSH? Is it purely so you don’t have to self manage known_hosts, based on mutual trust with the CA? Edit: or is there some ability for clients to leverage the CA to establish trusts without authorized_keys?
- pritambaral 4y agoBoth. Either. See more: https://web.archive.org/web/20201203110622/https://ef.gy/hardening-ssh https://web.archive.org/web/20201203110622/https://ef.gy/har...