5 ms·
There is only one public key that installed on the servers. That key is the same everywhere. You have a self-serve system that generates short-lived certs to us
by jyounker 2y ago
There is only one public key that installed on the servers. That key is the same everywhere. You have a self-serve system that generates short-lived certs to users.
- SoftTalker 2y agoYou can put the a regular SSH public key in LDAP, that’s pretty widely supported.
- jodrellblank 2y agoCan you be more specific? What public key is installed where on the servers? What self-serve system where generating certs how and in what form do users get them and what do they do with them? And how is the user authenticating to the self-serve system - username/password? And why can't they just do that to the SSH server?
- m-a-r-c-e-l 2y agoHey, have a look at this https://smallstep.com/blog/use-ssh-certificates/ https://smallstep.com/blog/use-ssh-certificates/
- ianburrell 2y agoThe company certificate is put on the server. Manually, the sysadmin generates the user key signed by certificate and sends it to them. Or the self-serve system generates it and they download it. The user uses the SSH key as normal. The server checks that if key is signed. The self-serve system uses the single-sign-on system for the company. The SSH server can't do SSO, maybe can do LDAP, but it is giant annoyance to set it up. A lot SSH use assumes that using key and doesn't support username/password.