3 ms·
Engineering Secure SSH Access for Engineers
- transpute 2y agoDirect link: https://interrupt.memfault.com/blog/eoss-recap#engineering-secure-ssh-access-for-engineers https://interrupt.memfault.com/blog/eoss-recap#engineering-s... > Colin (Garmin) goes through the challenges for enabling SSH access to devices in production. Passwords and secret keys are not great solutions: if you share one across all your devices then a leak would be catastrophic. And a leak is hard to protect against because the engineers need the keys with them when doing maintenance work. So instead, he recommends using certificates to create keys that are only valid for one hour or one day. The device SSH daemon validates that the engineer key has been signed by the proper certificate, and that we are still within the correct validity period. This way, the only real secret (the private key used to sign the keys) can be stored in a very safe storage, engineers are only granted access for a few hours (so an ex-employee will not have access anymore).