3 ms·
There is an easier way: Create a SSH CA, add that to your authorized_keys everywhere, use it to sign the individual public keys.
by yjftsjthsd-h 11mo ago
There is an easier way: Create a SSH CA, add that to your authorized_keys everywhere, use it to sign the individual public keys.
- arianvanp 11mo agoYep that's what I do! I have two ssh-ca's stored on two Yubikeys. And both are trusted by my servers. If I lose one I can still sign new certs with the other. https://github.com/arianvp/nixos-stuff/blob/master/modules/ssh.nix https://github.com/arianvp/nixos-stuff/blob/master/modules/s...
- lxgr 11mo agoBut now you need to worry about revocation or at least key lifetimes.
- yjftsjthsd-h 11mo agoI would argue that doing both of those is still less work than maintaining authorized_keys in many places.
- morshu9001 11mo agoYes, also idk if the other way works with Secure Enclave
- morshu9001 11mo agooops replied to wrong comment
- morshu9001 11mo agoThat's good but more complicated, and not everything supports it. Like on GitHub, SSH CA requires subscribing to their enterprise service. Also idk if you can store the root or the resulting signed key in the enclave the way this article says.