Re:OpenSSH: client bug CVE-2016-0777
by jethro_tell on Thursday January 14, 2016 @04:53PM
(#10904846)
Well I have an automated credentials and authentication infrastructure in place. The point is that if I have 50 hosts (and my infrastructure has considerably more) and 3 employees with 50 keys each, there will be 2 key changes a day on a 90 day rotation.
Are my guys going to spend 5 minutes every morning making and pushing keys?
What if my hosts auto provision themselves and there are 5 new hosts every morning?
Am I going to make keys as part of infrastructure deployments and push them back to the workstations and update other peoples ssh configs?
I'm just saying if you've worked at scale, you'll realize that a key per box won't scale. I mean, anything can scale if you put enough effort into it. But the chances of disaster in lack of access or security breach, from over complication is way to high here.
Automating bad processes just makes it easier for them to fuck you.
What do you do now if someone leaves? Remove that person's key from all 50 hosts one at a time?
Or, at the very least, you use tmux with sync panes or csshx - and log into all 50 hosts at once, and then you can issue one rm / scp command if you are still doing things manually.