3 ms·
If you have one server, that sounds great. If you have 60, it does not.
by hamburglar 13y ago
If you have one server, that sounds great. If you have 60, it does not.
- calpaterson 13y agoIf you have 60 servers you are hopefully using some kind of configuration automation, like puppet or chef...?
- hamburglar 13y agoYes, but in my experience, doing that for client machines (where you need to check the fingerprints) is pretty atypical.
- parfe 13y agoFor the love of god why have 60 servers with ssh available open to the world? Ssh through trusted gateway machine! Then you need a single signature you trust and you can firewall off the rest of your hardware.
- hamburglar 13y agoFor the love of god why would you assume this has anything to do with "open to the world"? When I proxy through the trusted ssh gateway to the firewalled servers (using ssh ProxyCommand), I still like my client to verify the signature.
- narsil 13y agoI would assume that if your internal network is "trusted", then the risk of a MitM is low enough that you wouldn't have to check the signature. I agree that an extra layer of validation is always a nice thing to have, but everyone has different levels of acceptable inconvenience with regards to security.
- dllthomas 13y agoYou could store the signatures on one server, and import them in bulk. Then you still just need to write down the one signature.
- hamburglar 13y agoYes, there are many ways you can work around the problem of ssh needing manual inspection of individual host keys, and the method you propose is pretty reasonable. But building the verification into the infrastructure is a very sensible and nice way of handling it, and lets everyone throw out their individual ad-hoc solutions to this problem.
- seanlinmt 13y agoOr if you're running windows you can use group policy and windows PKI to get it done automatically. But I haven't found out how to do the same thing under a nix environment.
- seanlinmt 13y agoOr if you're running windows you can use group policy and windows PKI to get it done automatically. But I haven't found out how to do the same thing under a nix environment.
- seanlinmt 13y agoOr if you're running windows you can use group policy and windows PKI to get it done automatically. But I haven't found out how to do the same thing under a nix environment.
- seanlinmt 13y agoOr if you're running windows you can use group policy and windows PKI to get it done automatically. But I haven't found out how to do the same thing under a nix environment.
- seanlinmt 13y agoOr if you're running windows you can use group policy and windows PKI to get it done automatically. But I haven't found out how to do the same thing under a nix environment.
- seanlinmt 13y agoOr if you're running windows you can use group policy and windows PKI to get it done automatically. But I haven't found out how to do the same thing under a nix environment.