4 ms·

You require DNSSEC before deploying a SSHFP (SSH fingerprint) DNS resource record. Details: https://egbert.net/blog/articles/dns-rr-sshfp.html https://egbert.n

You require DNSSEC before deploying a SSHFP (SSH fingerprint) DNS resource record. Details: https://egbert.net/blog/articles/dns-rr-sshfp.html https://egbert.net/blog/articles/dns-rr-sshfp.html

tptacek 1y ago
Why would you ever tie your SSH deployment to a global PKI? You are the entire source of truth for what is and isn't authentic in your own fleet. This is what SSH CA's are for.
- egberts1 1y ago
  One can have a PK for the machine and a separate PK for the login user. Best for anonymous mobile.
  - akerl_ 1y ago
    Why would you want to tie either of those to a global PKI?
    - egberts1 1y ago
      Pertains to a certain NetOp scenarioes.
      - akerl_ 1y ago
        I’m not sure what that would even mean. What is the network operation scenario where you want the credentials for your machines to be tied to a global PKI tree whose roots are all either multinational companies or world governments.