2 ms·
Zero trust. But they don't solve the more interesting problem: host key authentication. Would be nice if they can replace TOFU access with SSH CA as well. Idea
by arianvanp 2y ago
Zero trust. But they don't solve the more interesting problem: host key authentication.
Would be nice if they can replace TOFU access with SSH CA as well. Ideally based on device posture of the server (e.g. TPM2 attestation)
- mdaniel 2y agoWhile not applicable for all situations <https://en.wikipedia.org/wiki/SSHFP_record https://en.wikipedia.org/wiki/SSHFP_record> and its <https://man.openbsd.org/ssh_config.5#VerifyHostKeyDNS https://man.openbsd.org/ssh_config.5#VerifyHostKeyDNS> friend may interest you
- udev4096 2y agoI was not aware of using random[0] ASCII art as a way to check if the host key has changed [0] - https://man.openbsd.org/ssh.1#random https://man.openbsd.org/ssh.1#random
- anilakar 2y agoAs far as I know you can CA sign host keys the same way you can sign users' public keys. As always, the main issue is that certificate chaining is not possible in SSH PK"I", so you need to have absolute trust in the machine that does the signing.