4 ms·
For the love of god why would you assume this has anything to do with "open to the world"? When I proxy through the trusted ssh gateway to the firewalled serve
by hamburglar 13y ago
For the love of god why would you assume this has anything to do with "open to the world"? When I proxy through the trusted ssh gateway to the firewalled servers (using ssh ProxyCommand), I still like my client to verify the signature.
- narsil 13y agoI would assume that if your internal network is "trusted", then the risk of a MitM is low enough that you wouldn't have to check the signature. I agree that an extra layer of validation is always a nice thing to have, but everyone has different levels of acceptable inconvenience with regards to security.
- dllthomas 13y agoYou could store the signatures on one server, and import them in bulk. Then you still just need to write down the one signature.
- hamburglar 13y agoYes, there are many ways you can work around the problem of ssh needing manual inspection of individual host keys, and the method you propose is pretty reasonable. But building the verification into the infrastructure is a very sensible and nice way of handling it, and lets everyone throw out their individual ad-hoc solutions to this problem.