3 ms·
It was for me too. But when ordered by my boss to implement SSHFP, the hacker in me took it apart and made this checklist. In hindsight, it isn't a very useab
by egberts1 1y ago
It was for me too. But when ordered by my boss to implement SSHFP, the hacker in me took it apart and made this checklist.
In hindsight, it isn't a very useable DNS RCODE.
And yes, it is preferable to use SSH certificates (for as long as you are aware that private keys must be guarded jealously). We need PAKE capability in SSH, preferably Signal-like protocol for authentication.
- egberts1 1y agoOh yeah, you are better off having a separate but hardened SSH authentication server that is to be consulted by such SSH gateways, just to protect the private keys. And use DTLS (two sets of client and server PKI , one for each direction) to guard that link between SSH gatewat(s) and SSH authentication (certificate-based) server. The starting point of all this: https://jpmens.net/2019/03/02/sshd-and-authorizedkeyscommand/ https://jpmens.net/2019/03/02/sshd-and-authorizedkeyscommand...